v0.3.7: 全面代码审计修复 - 20项Bug/安全/稳定性改进

src/main/file-system.ts

@@ -1,4 +1,4 @@
-import { readFile, stat, writeFile, rename, readdir, unlink } from 'fs/promises'
+import { readFile, stat, writeFile, rename, readdir, unlink, lstat, realpath } from 'fs/promises'
 import { join, extname, dirname, basename } from 'path'
 import type { ReadFileResult, SaveFileResult, FileNode } from '../shared/types'
 import { MAX_FILE_SIZE, ALLOWED_EXTENSIONS, SKIP_DIRS } from '../shared/constants'
@@ -33,10 +33,29 @@ export async function saveFileContent(filePath: string, content: string): Promis
   }
 }
 
-// M-05: 递归深度限制 + 错误边界
-export async function buildDirTree(dirPath: string, depth = 0, maxDepth = 10): Promise<FileNode[]> {
+// M-05: 递归深度限制 + 错误边界 + 符号链接循环检测
+export async function buildDirTree(
+  dirPath: string,
+  depth = 0,
+  maxDepth = 10,
+  visited?: Set<string>
+): Promise<FileNode[]> {
   if (depth > maxDepth) return []
 
+  if (!visited) visited = new Set<string>()
+
+  // 检测符号链接循环
+  let realPath: string
+  try {
+    const ls = await lstat(dirPath)
+    if (ls.isSymbolicLink()) return []
+    realPath = await realpath(dirPath)
+  } catch {
+    return []
+  }
+  if (visited.has(realPath)) return []
+  visited.add(realPath)
+
   let entries
   try {
     entries = await readdir(dirPath, { withFileTypes: true })
@@ -57,7 +76,7 @@ export async function buildDirTree(dirPath: string, depth = 0, maxDepth = 10): P
 
     const childPath = join(dirPath, entry.name)
     if (entry.isDirectory()) {
-      const subChildren = await buildDirTree(childPath, depth + 1, maxDepth)
+      const subChildren = await buildDirTree(childPath, depth + 1, maxDepth, visited)
       if (subChildren.length > 0) {
         children.push({ name: entry.name, path: childPath, type: 'dir', children: subChildren })
       }