添加uv支持 (#2119)

* bugfix:修复内存泄露和信号量饥饿问题

* 修复图片渲染按高度截断问题

* 优化图片渲染速度

* 权限检查去掉无效引用代码

* 添加uv支持

* 🚨 auto fix by pre-commit hooks

* bugfix:修改gitignore换行

* bugfix:修复测试没有新生成uv.lock

* 修复导入错误

* bugfix:移除重复调用

* 🚨 auto fix by pre-commit hooks

* 清理残余poetry引用

* 更新uv安装方式

* 修复阿里云获取问题

* 增加资源下载提示

* 🚨 auto fix by pre-commit hooks

* 修改资源下载为流式

* 🚨 auto fix by pre-commit hooks

* 提高启动速度

* 移除bot.py支持

* 🚨 auto fix by pre-commit hooks

* 优化win脚本逻辑

* 🚨 auto fix by pre-commit hooks

* 清理残余无效逻辑

* 代码改进

* 🚨 auto fix by pre-commit hooks

* 增加数据库迁移存在性检查

* 🚨 auto fix by pre-commit hooks

* chore(test): 添加pytest超时控制和优雅关闭机制

- 在GitHub Actions工作流中添加作业级和步骤级超时限制，防止测试无限期挂起
- 添加pytest-timeout依赖并配置全局超时为120秒
- 在send_queue服务添加关闭钩子，确保worker任务正确取消
- 在priority_manager添加on_shutdown钩子，支持优先级生命周期的关闭阶段

* chore(lint): 禁用超长行的lint警告

* Modify restart logic for Windows platform

* 🚨 auto fix by pre-commit hooks

* bugfix:修复sys导入问题

* 清理无效结构

* bugfix:修复路径问题

* bugfix:修复shell语法传递给git导致资源获取失败问题

* 优化关闭显示

* bugfix:修复路径问题

* bugfix:增加路径安全

* bugfix:修复orm绕过问题

* 放宽numpy版本限制

* 修改重启方案

* bugfix:修复循环导入

* 优化逻辑

* Enhance disconnect function with error handling

Added error handling for disconnect function and imported ConfigurationError.

* Implement emergency restart mechanism

Added emergency restart mechanism using atexit to ensure process restart even on severe exceptions during shutdown.

* 🚨 auto fix by pre-commit hooks

* 重启行为归一化

* 修复测试检测问题

* bugfix:修复测试侧类型报错问题

* 引入launcher机制

* 移除重启测试

* 收紧缓存调用路径

* 类型注解收敛

* 优化浏览器回收行为

* 优化浏览器渲染

* bugfix:解决重复关闭浏览器问题

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: ManyManyTomato <93612024+ATTomatoo@users.noreply.github.com>
Co-authored-by: AkashiCoin <l1040186796@gmail.com>

zhenxun/builtin_plugins/web_ui/api/tabs/system/__init__.py

@@ -9,7 +9,7 @@ from fastapi.responses import JSONResponse
 from zhenxun.utils._build_image import BuildImage
 
 from ....base_model import Result, SystemFolderSize
-from ....utils import authentication, get_system_disk, validate_path
+from ....utils import authentication, get_system_disk, validate_filename, validate_path
 from .model import AddFile, DeleteFile, DirFile, RenameFile, SaveFile
 
 router = APIRouter(prefix="/system")
@@ -120,11 +120,22 @@ async def _(param: RenameFile) -> Result:
     if not parent_path:
         return Result.fail("无效的路径")
 
-    path = (parent_path / param.old_name) if param.parent else Path(param.old_name)
+    if err := validate_filename(param.old_name):
+        return Result.fail(err)
+    if err := validate_filename(param.name):
+        return Result.fail(err)
+
+    root = os.path.realpath(Path())
+    path = Path(os.path.realpath(parent_path / param.old_name))
+    if not str(path).startswith(root + os.sep):
+        return Result.fail("访问路径超出允许范围")
     if not path.exists():
         return Result.warning_("文件不存在...")
     try:
-        path.rename(path.parent / param.name)
+        dest = Path(os.path.realpath(path.parent / param.name))
+        if not str(dest).startswith(root + os.sep):
+            return Result.fail("目标路径超出允许范围")
+        path.rename(dest)
         return Result.ok("重命名成功!")
     except Exception as e:
         return Result.warning_(f"重命名失败: {e!s}")
@@ -144,12 +155,22 @@ async def _(param: RenameFile) -> Result:
     if not parent_path:
         return Result.fail("无效的路径")
 
-    path = (parent_path / param.old_name) if param.parent else Path(param.old_name)
+    if err := validate_filename(param.old_name):
+        return Result.fail(err)
+    if err := validate_filename(param.name):
+        return Result.fail(err)
+
+    root = os.path.realpath(Path())
+    path = Path(os.path.realpath(parent_path / param.old_name))
+    if not str(path).startswith(root + os.sep):
+        return Result.fail("访问路径超出允许范围")
     if not path.exists() or path.is_file():
         return Result.warning_("文件夹不存在...")
     try:
-        new_path = path.parent / param.name
-        shutil.move(path.absolute(), new_path.absolute())
+        dest = Path(os.path.realpath(path.parent / param.name))
+        if not str(dest).startswith(root + os.sep):
+            return Result.fail("目标路径超出允许范围")
+        shutil.move(path.absolute(), dest)
         return Result.ok("重命名成功!")
     except Exception as e:
         return Result.warning_(f"重命名失败: {e!s}")
@@ -169,11 +190,19 @@ async def _(param: AddFile) -> Result:
     if not parent_path:
         return Result.fail("无效的路径")
 
+    if err := validate_filename(param.name):
+        return Result.fail(err)
+
     path = (parent_path / param.name) if param.parent else Path(param.name)
+    # 二次确认拼接后路径仍在允许范围内
+    resolved, err = validate_path(str(path))
+    if err or not resolved:
+        return Result.fail(err or "无效的路径")
+    path = resolved
     if path.exists():
         return Result.warning_("文件已存在...")
     try:
-        path.open("w")
+        path.touch()
         return Result.ok("新建文件成功!")
     except Exception as e:
         return Result.warning_(f"新建文件失败: {e!s}")
@@ -193,7 +222,15 @@ async def _(param: AddFile) -> Result:
     if not parent_path:
         return Result.fail("无效的路径")
 
+    if err := validate_filename(param.name):
+        return Result.fail(err)
+
     path = (parent_path / param.name) if param.parent else Path(param.name)
+    # 二次确认拼接后路径仍在允许范围内
+    resolved, err = validate_path(str(path))
+    if err or not resolved:
+        return Result.fail(err or "无效的路径")
+    path = resolved
     if path.exists():
         return Result.warning_("文件夹已存在...")
     try: