update: validate_target_path

common/src/common/storage/schemas.py

@@ -36,6 +36,19 @@ class CreateUploadRequest(StrictModel):
     visibility: Literal["private", "workspace", "public"] = "private"
     is_immutable: bool = False
 
+    target_path: str = Field(default="", max_length=1024)
+
+    @field_validator("target_path")
+    @classmethod
+    def validate_target_path(cls, value: str) -> str:
+        # POSIX 相对路径，不能含 ..、绝对前缀、控制字符
+        if value and (value.startswith("/") or "\\" in value
+                      or any(seg == ".." for seg in value.split("/"))
+                      or any(ord(c) < 0x20 or ord(c) == 0x7F for c in value)):
+            raise ValueError("target_path must be a clean relative POSIX path")
+        # 去前导 /；允许尾部 /
+        return value.strip("/")
+
     @field_validator("expected_hash")
     @classmethod
     def validate_hash(cls, value: str | None) -> str | None: