修复: AI工具OOM/路径遍历+续跑锁收敛+UX交互批

2026-06-17 14:07:16 +08:00
parent 2065335c8c
commit 6b67214395
15 changed files with 390 additions and 98 deletions
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -36,6 +36,8 @@ df-project = { path = "../crates/df-project" }
 futures = "0.3"
 # write_file base64 编码:写二进制/非 UTF-8 文件(图片/PDF/Excel 等)
 base64 = "0.22"
+# validate_path URL 解码:防 %2e%2e 等 URL 编码绕过路径遍历检查(BUG-260617-03)
+percent-encoding = "2"
 # keyring:密钥解析下沉到 df-storage(workspace 统一声明平台 feature),
 # src-tauri 经 workspace 引用(转发壳 build_provider_for 不直接碰 keyring,但旧路径/兼容保留)。
 # 根因见 docs/09-问题排查/aichat-apikey-401排查-2026-06-15.md