From 93ab0732086b2803bdc15f0f136a317011994020 Mon Sep 17 00:00:00 2001 From: CaptainB Date: Mon, 28 Sep 2026 10:01:59 +0800 Subject: [PATCH] chore: sanitize knowledge file name to prevent invalid characters --- apps/knowledge/serializers/document.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/knowledge/serializers/document.py b/apps/knowledge/serializers/document.py index 251514e7903..f1b2e8a399a 100644 --- a/apps/knowledge/serializers/document.py +++ b/apps/knowledge/serializers/document.py @@ -1637,7 +1637,8 @@ def batch_export_zip(self, instance: Dict, with_valid=True): response = HttpResponse(content_type="application/zip") zip_buffer = io.BytesIO() with TemporaryDirectory() as tempdir: - knowledge_file = os.path.join(tempdir, f"{knowledge.name}.xlsx") + safe_name = re.sub(r'[<>:"/\\|?*\x00-\x1f]', "_", knowledge.name).strip(" .") or "knowledge" + knowledge_file = os.path.join(tempdir, f"{safe_name}.xlsx") workbook.save(knowledge_file) for r in res: write_image(tempdir, r)