1111

Assets/00.StaryEvoTools/Runtime/Tools/ZipTool.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.IO.Compression;
+using System.Threading;
 using Cysharp.Threading.Tasks;
 using UnityEngine;
 using UnityEngine.Networking;
@@ -10,6 +11,7 @@ namespace Stary.Evo
 {
     public class ZipTool
     {
+        private static SemaphoreSlim unzipLock = new(1, 1);
         // 新增：带进度回调的下载解压方法
         public static async UniTask DownloadAndUnzipAsync(string fildId, string extractPath,
             Action<float> downloadProgress = null, Action<float> unzipProgress = null)
@@ -41,7 +43,9 @@ namespace Stary.Evo
         {
             try
             {
-              
+                // 验证路径安全性
+                string fullExtractPath = Path.GetFullPath(extractPath);
+
                 using (ZipArchive archive = ZipFile.OpenRead(zipPath))
                 {
                     float totalEntries = archive.Entries.Count;
@@ -49,7 +53,13 @@ namespace Stary.Evo
 
                     foreach (ZipArchiveEntry entry in archive.Entries)
                     {
-                        string filePath = Path.Combine(extractPath, entry.FullName);
+                        // 安全检查：防止目录遍历
+                        string filePath = Path.GetFullPath(Path.Combine(extractPath, entry.FullName));
+                        if (!filePath.StartsWith(fullExtractPath))
+                        {
+                            Debug.LogWarning($"跳过不安全的文件路径: {entry.FullName}");
+                            continue;
+                        }
                         Directory.CreateDirectory(Path.GetDirectoryName(filePath));
 
                         if (!string.IsNullOrEmpty(entry.Name))
@@ -57,7 +67,7 @@ namespace Stary.Evo
                             using (Stream inputStream = entry.Open())
                             using (FileStream outputStream = File.Create(filePath))
                             {
-                                await inputStream.CopyToAsync(outputStream);
+                                await inputStream.CopyToAsync(outputStream,81920);
                             }
                         }
 
@@ -71,7 +81,7 @@ namespace Stary.Evo
             catch (Exception ex)
             {
                 Debug.LogError($"解压失败: {ex.Message}");
-                throw;
+                throw; // 重新抛出异常让调用方处理
             }
         }