fix: properly add isFilePathSafe — isPathSafe allows absolute paths for projectPath

src/app/lib/novel-server-utils.ts

@@ -19,15 +19,18 @@ export function isPathSafe(inputPath: string): boolean {
   if (inputPath.includes('../') || inputPath.includes('..\\')) return false;
   // Block URL-encoded traversal
   if (/%2e%2e/i.test(inputPath)) return false;
-  // Block absolute paths (path.join collapses them, bypassing prefix)
-  if (inputPath.startsWith('/') || inputPath.startsWith('\\')) return false;
-  // Block Windows drive letter absolute paths (e.g. C:\)
-  if (/^[a-zA-Z]:[/\\]/.test(inputPath)) return false;
   // Block null bytes
   if (inputPath.includes('\0')) return false;
   return true;
 }
 
+export function isFilePathSafe(filePath: string): boolean {
+  if (!filePath || typeof filePath !== 'string') return false;
+  if (filePath.startsWith('/') || filePath.startsWith('\\')) return false;
+  if (/^[a-zA-Z]:[/\\]/.test(filePath)) return false;
+  return isPathSafe(filePath);
+}
+
 /**
  * 检测指定路径下是否存在 novel_project.json，判断是否为有效项目目录
  */