From 225a5854998298dfb2ec0800fe6f2c8fec89b086 Mon Sep 17 00:00:00 2001
From: "tao.chen" <93983997+taochen-ct@users.noreply.github.com>
Date: Fri, 14 Aug 2026 11:32:15 +0800
Subject: [PATCH] update: validate_target_path

---
 common/src/common/storage/schemas.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/common/src/common/storage/schemas.py b/common/src/common/storage/schemas.py
index 2538558..8e6403a 100644
--- a/common/src/common/storage/schemas.py
+++ b/common/src/common/storage/schemas.py
@@ -36,6 +36,19 @@ class CreateUploadRequest(StrictModel):
     visibility: Literal["private", "workspace", "public"] = "private"
     is_immutable: bool = False
 
+    target_path: str = Field(default="", max_length=1024)
+
+    @field_validator("target_path")
+    @classmethod
+    def validate_target_path(cls, value: str) -> str:
+        # POSIX 相对路径，不能含 ..、绝对前缀、控制字符
+        if value and (value.startswith("/") or "\\" in value
+                      or any(seg == ".." for seg in value.split("/"))
+                      or any(ord(c) < 0x20 or ord(c) == 0x7F for c in value)):
+            raise ValueError("target_path must be a clean relative POSIX path")
+        # 去前导 /；允许尾部 /
+        return value.strip("/")
+
     @field_validator("expected_hash")
     @classmethod
     def validate_hash(cls, value: str | None) -> str | None: