feat: sync portal runtime fixes for release

2026-06-27 22:28:41 +08:00
parent 8264e71f9e
commit 4a9bc710f1
14 changed files with 795 additions and 130 deletions
@@ -40,6 +40,9 @@ function resolveSandboxed(p) {
  if (resolved !== SANDBOX && !resolved.startsWith(SANDBOX + path.sep)) {
    throw Object.assign(new Error(`路径越界：${p} 不在当前工作区内`), { code: 'EACCES' });
  }
+  if (resolved === PRIVATE_DATA_DIR || resolved.startsWith(PRIVATE_DATA_DIR + path.sep)) {
+    throw Object.assign(new Error('禁止直接访问私有数据目录，请使用 private_data_* 工具'), { code: 'EACCES' });
+  }
  return resolved;
 }