feat: dir and file check

internal/operations/fs.go

@@ -26,6 +26,9 @@ func List(ctx context.Context, account driver.Driver, path string, refresh ...bo
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed get dir")
 	}
+	if !dir.IsDir() {
+		return nil, errors.WithStack(errs.NotFolder)
+	}
 	if account.Config().NoCache {
 		return account.List(ctx, dir)
 	}

internal/operations/path.go

@@ -1,6 +1,7 @@
 package operations
 
 import (
+	"github.com/alist-org/alist/v3/internal/errs"
 	stdpath "path"
 	"strings"
 
@@ -21,6 +22,9 @@ func ActualPath(account driver.Additional, rawPath string) string {
 // for path: remove the virtual path prefix and join the actual root folder if exists
 func GetAccountAndActualPath(rawPath string) (driver.Driver, string, error) {
 	rawPath = utils.StandardizationPath(rawPath)
+	if strings.Contains(rawPath, "..") {
+		return nil, "", errors.WithStack(errs.RelativePath)
+	}
 	account := GetBalancedAccount(rawPath)
 	if account == nil {
 		return nil, "", errors.Errorf("can't find account with rawPath: %s", rawPath)