From 76cea31c044349d11b5727b7582d59ad4cc8b4ad Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Mon, 31 Aug 2026 09:42:33 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A7=84=E8=8C=83=E5=8C=96=E8=BF=9C=E7=A8=8B?=
 =?UTF-8?q?=E8=AF=81=E4=B9=A6=E8=B7=AF=E5=BE=84=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/deployment/model.go      |  9 ++++++++-
 backend/internal/deployment/model_test.go | 22 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/backend/internal/deployment/model.go b/backend/internal/deployment/model.go
index 3bf9c8b..855c5d3 100644
--- a/backend/internal/deployment/model.go
+++ b/backend/internal/deployment/model.go
@@ -106,6 +106,13 @@ func ResolveServerPaths(server Server, domainName, certificateType string) (Serv
 	if err != nil {
 		return Server{}, err
 	}
+	if err := validateDeploymentPaths([]remoteFile{
+		{path: server.CertificatePath},
+		{path: server.CertificateChainPath},
+		{path: server.PrivateKeyPath},
+	}); err != nil {
+		return Server{}, err
+	}
 	return server, nil
 }
 
@@ -130,7 +137,7 @@ func resolveServerPathTemplate(label, value string, replacer *strings.Replacer)
 	if !strings.HasPrefix(cleaned, "/") {
 		return "", fmt.Errorf("%s必须是绝对路径", label)
 	}
-	return resolved, nil
+	return cleaned, nil
 }
 
 func (s Server) Validate() error {
diff --git a/backend/internal/deployment/model_test.go b/backend/internal/deployment/model_test.go
index 6125ea7..a449e80 100644
--- a/backend/internal/deployment/model_test.go
+++ b/backend/internal/deployment/model_test.go
@@ -75,6 +75,28 @@ func TestResolveServerPathsRejectsRelativePath(t *testing.T) {
 	}
 }
 
+func TestResolveServerPathsCanonicalizesPathAndRejectsDuplicate(t *testing.T) {
+	server := testServer("one")
+	server.CertificatePath = "/ssl/example/../example/cert.pem"
+	resolved, err := ResolveServerPaths(server, "example.com", "single")
+	if err != nil {
+		t.Fatalf("path normalization failed: %v", err)
+	}
+	if resolved.CertificatePath != "/ssl/example/cert.pem" {
+		t.Fatalf("unexpected normalized path: %s", resolved.CertificatePath)
+	}
+
+	server = testServer("one")
+	server.CertificatePath = "/ssl/example/../example/cert.pem"
+	server.PrivateKeyPath = "/ssl/example/../example/cert.pem"
+	if _, err := ResolveServerPaths(server, "example.com", "single"); err == nil {
+		FatalUnexpectedPath(t)
+	}
+}
+func FatalUnexpectedPath(t *testing.T) {
+	t.Helper()
+	t.Fatal("duplicate path accepted")
+}
 func TestServerRejectsPasswordStyleOrUnsafeConfiguration(t *testing.T) {
 	server := testServer("one")
 	server.PrivateKeyRef = ""