diff --git a/lib/models/files.ts b/lib/models/files.ts index f8de55a..b068f6c 100644 --- a/lib/models/files.ts +++ b/lib/models/files.ts @@ -598,7 +598,11 @@ export async function ensureUserPathIsValidAndSecurelyAccessible(userId: string, const resolvedFullPath = `${resolve(fullPath)}/`; - if (!resolvedFullPath.startsWith(userRootPath)) { + // Normalize path separators for consistent comparison on Windows + const normalizedUserRootPath = userRootPath.replace(/\\/g, '/'); + const normalizedResolvedFullPath = resolvedFullPath.replace(/\\/g, '/'); + + if (!normalizedResolvedFullPath.startsWith(normalizedUserRootPath)) { throw new Error('Invalid file path'); } }