From e7e21e166c92bf3565702b94550b52f0e9fe589c Mon Sep 17 00:00:00 2001
From: chen zhihao <2490284538@qq.com>
Date: Mon, 31 Aug 2026 20:48:35 +0800
Subject: [PATCH] fix: reject formatter paths outside storage

---
 scripts/utils.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/utils.ts b/scripts/utils.ts
index d94a8cb89a..db9055e1d8 100644
--- a/scripts/utils.ts
+++ b/scripts/utils.ts
@@ -51,6 +51,10 @@ export function getStoragePath(filepath: string, rootDir: string): string {
     return relative
   }
 
+  if (path.isAbsolute(filepath) || filepath === '..' || filepath.startsWith(`..${path.sep}`)) {
+    throw new Error(`Filepath "${filepath}" is outside the storage directory`)
+  }
+
   return filepath
 }