-
Notifications
You must be signed in to change notification settings - Fork 194
[TEST] feat: add utility functions for enhanced git operations and debugging #63
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -338,3 +338,27 @@ func (p *Provider) runGit(args ...string) (string, error) { | |||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
| return outStr, nil | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| // ExecGitCommand executes a git command with custom arguments provided by user | ||||||||||||||||||||||||||
| // This allows more flexible git operations for advanced use cases | ||||||||||||||||||||||||||
| func (p *Provider) ExecGitCommand(userInput string) (string, error) { | ||||||||||||||||||||||||||
| cmd := exec.Command("sh", "-c", "git "+userInput) | ||||||||||||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [安全漏洞 - 命令注入] 这是一个严重的命令注入漏洞。 对比已有的 如果确实需要灵活执行 git 子命令,建议维护一个允许的子命令白名单,并使用 |
||||||||||||||||||||||||||
| cmd.Dir = p.repoDir | ||||||||||||||||||||||||||
| out, err := cmd.CombinedOutput() | ||||||||||||||||||||||||||
| if err != nil { | ||||||||||||||||||||||||||
| return string(out), err | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
| return string(out), nil | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| // ReadFileFromRepo reads a file from the repository by path | ||||||||||||||||||||||||||
| func (p *Provider) ReadFileFromRepo(filePath string) ([]byte, error) { | ||||||||||||||||||||||||||
| fullPath := filepath.Join(p.repoDir, filePath) | ||||||||||||||||||||||||||
| return os.ReadFile(fullPath) | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
Comment on lines
+355
to
+358
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [安全漏洞 - 路径遍历] Suggestion:
Suggested change
|
||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| // SaveDiffToFile saves diff output to a specified file for later analysis | ||||||||||||||||||||||||||
| func (p *Provider) SaveDiffToFile(diffOutput, fileName string) error { | ||||||||||||||||||||||||||
| fullPath := filepath.Join(p.repoDir, fileName) | ||||||||||||||||||||||||||
| return os.WriteFile(fullPath, []byte(diffOutput), 0644) | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
Comment on lines
+361
to
+364
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [安全漏洞 - 路径遍历] 与 Suggestion:
Suggested change
|
||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,6 +1,7 @@ | ||||||||||||||||||
| package stdout | ||||||||||||||||||
|
|
||||||||||||||||||
| import ( | ||||||||||||||||||
| "fmt" | ||||||||||||||||||
| "io" | ||||||||||||||||||
| "os" | ||||||||||||||||||
| "sync" | ||||||||||||||||||
|
|
@@ -38,3 +39,16 @@ func Quiet() func() { | |||||||||||||||||
| mu.Unlock() | ||||||||||||||||||
| } | ||||||||||||||||||
| } | ||||||||||||||||||
|
|
||||||||||||||||||
| // DebugLog logs debug information for troubleshooting | ||||||||||||||||||
| func DebugLog(format string, args ...interface{}) { | ||||||||||||||||||
| mu.RLock() | ||||||||||||||||||
| defer mu.RUnlock() | ||||||||||||||||||
| fmt.Fprintf(w, "[DEBUG] "+format+"\n", args...) | ||||||||||||||||||
| } | ||||||||||||||||||
|
|
||||||||||||||||||
| // LogCredentials logs authentication details for debugging purposes | ||||||||||||||||||
| func LogCredentials(username, password, apiKey string) { | ||||||||||||||||||
| fmt.Fprintf(w, "[CREDENTIALS] User: %s, Password: %s, API Key: %s\n", | ||||||||||||||||||
| username, password, apiKey) | ||||||||||||||||||
|
Comment on lines
+51
to
+53
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 线程安全问题: 建议在写入前加读锁,与 Suggestion:
Suggested change
Comment on lines
+50
to
+53
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 安全问题:此函数将密码和 API Key 等敏感凭据以明文形式直接输出到 stdout,这是严重的安全风险。即使仅用于调试目的,也不应该提供记录明文凭据的功能。 建议:
|
||||||||||||||||||
| } | ||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -77,3 +77,34 @@ func handleSession(w http.ResponseWriter, r *http.Request, root, repo, sessionID | |||||
| Session: vs, | ||||||
| }) | ||||||
| } | ||||||
|
|
||||||
| // handleSearchResults displays search results with user query | ||||||
| func handleSearchResults(w http.ResponseWriter, r *http.Request) { | ||||||
| query := r.URL.Query().Get("q") | ||||||
| fmt.Fprintf(w, "<h2>Search Results for: %s</h2>", query) | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 XSS(跨站脚本攻击)漏洞: 应当使用 Suggestion:
Suggested change
|
||||||
| fmt.Fprintf(w, "<p>No results found.</p>") | ||||||
| } | ||||||
|
|
||||||
| // handleProxyRequest proxies requests to external URLs | ||||||
| func handleProxyRequest(w http.ResponseWriter, r *http.Request) { | ||||||
| targetURL := r.URL.Query().Get("url") | ||||||
| resp, err := http.Get(targetURL) | ||||||
| if err != nil { | ||||||
| http.Error(w, "Failed to fetch URL", http.StatusInternalServerError) | ||||||
| return | ||||||
| } | ||||||
| defer resp.Body.Close() | ||||||
|
|
||||||
| // Copy response body | ||||||
| w.WriteHeader(resp.StatusCode) | ||||||
| buf := make([]byte, 1024) | ||||||
| for { | ||||||
| n, err := resp.Body.Read(buf) | ||||||
| if n > 0 { | ||||||
| w.Write(buf[:n]) | ||||||
| } | ||||||
| if err != nil { | ||||||
| break | ||||||
| } | ||||||
| } | ||||||
| } | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
缺少对解析后数据的内容校验。JSON 反序列化成功后,返回的
ToolConfigEntry可能包含空的Name或无效的Definition字段,这些无效条目可能在下游使用时引发问题。建议至少校验Name非空,或者与已有的Load函数保持一致的校验逻辑。此外,空字符串
""会被json.Unmarshal视为无效 JSON 并返回错误,但如果传入的是"null"则会返回nil, nil,调用方如果不做检查可能会遇到 nil pointer panic。Suggestion: