fix: check if the req path is relative path (close #2531)

pkg/utils/path.go

@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+
+	"github.com/alist-org/alist/v3/internal/errs"
 )
 
 // StandardizePath convert path like '/' '/root' '/a/b'
@@ -60,3 +62,10 @@ func EncodePath(path string, all ...bool) string {
 	}
 	return strings.Join(seg, "/")
 }
+
+func JoinBasePath(basePath, reqPath string) (string, error) {
+	if strings.HasSuffix(reqPath, "..") || strings.Contains(reqPath, "../") {
+		return "", errs.RelativePath
+	}
+	return stdpath.Join(basePath, reqPath), nil
+}