LukeMackin/Yuzu-GCA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 安全CRITICAL—exec用净化命令+file_read/write/move全加safePath

Browse Source
This commit is contained in:
LukeMackin
2026-07-22 20:19:20 +08:00
parent 12e00bf683
commit fcfedf1ae0
1 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
packages/server/src/tools.ts
View File

@@ -19,7 +19,7 @@ function safePath(p: string): string {
return resolved; return resolved;
} }
// ── C-002: file_list ──────────────────────────────────────── // 鈹€鈹€ C-002: file_list 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
export async function file_list(args: { export async function file_list(args: {
path: string; path: string;
recursive?: boolean; recursive?: boolean;
@@ -34,7 +34,7 @@ export async function file_list(args: {
return { path: dir, entries: result, count: result.length }; return { path: dir, entries: result, count: result.length };
} }
// ── C-003: file_read ──────────────────────────────────────── // 鈹€鈹€ C-003: file_read 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
export async function file_read(args: { export async function file_read(args: {
path: string; path: string;
encoding?: string; encoding?: string;
@@ -42,17 +42,17 @@ export async function file_read(args: {
limit?: number; limit?: number;
}): Promise<any> { }): Promise<any> {
const encoding = (args.encoding === "base64" ? "base64" : "utf8") as BufferEncoding; const encoding = (args.encoding === "base64" ? "base64" : "utf8") as BufferEncoding;
let content = fs.readFileSync(args.path, encoding); let content = fs.readFileSync(safePath(args.path, encoding);
if (encoding === "utf8") { if (encoding === "utf8") {
const lines = (content as string).split("\n"); const lines = (content as string).split("\n");
const start = args.offset ?? 0; const start = args.offset ?? 0;
const end = args.limit ? start + args.limit : lines.length; const end = args.limit ? start + args.limit : lines.length;
content = lines.slice(start, end).join("\n"); content = lines.slice(start, end).join("\n");
} }
return { path: args.path, content, size: fs.statSync(args.path).size }; return { path: args.path, content, size: fs.statSync(safePath(args.path).size };
} }
// ── C-004: file_write ─────────────────────────────────────── // 鈹€鈹€ C-004: file_write 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
export async function file_write(args: { export async function file_write(args: {
path: string; path: string;
content: string; content: string;
@@ -60,21 +60,21 @@ export async function file_write(args: {
}): Promise<any> { }): Promise<any> {
const encoding = args.encoding === "base64" ? "base64" : "utf8"; const encoding = args.encoding === "base64" ? "base64" : "utf8";
fs.mkdirSync(path.dirname(args.path), { recursive: true }); fs.mkdirSync(path.dirname(args.path), { recursive: true });
fs.writeFileSync(args.path, args.content, encoding as BufferEncoding); fs.writeFileSync(safePath(args.path, args.content, encoding as BufferEncoding);
return { ok: true, path: args.path, size: fs.statSync(args.path).size }; return { ok: true, path: args.path, size: fs.statSync(safePath(args.path).size };
} }
// ── C-005: file_move ──────────────────────────────────────── // 鈹€鈹€ C-005: file_move 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
export async function file_move(args: { export async function file_move(args: {
from: string; from: string;
to: string; to: string;
}): Promise<any> { }): Promise<any> {
fs.mkdirSync(path.dirname(args.to), { recursive: true }); fs.mkdirSync(path.dirname(safePath(args.to)), { recursive: true });
fs.renameSync(args.from, args.to); fs.renameSync(safePath(args.from, args.to);
return { ok: true, from: args.from, to: args.to }; return { ok: true, from: args.from, to: args.to };
} }
// ── C-008: exec ───────────────────────────────────────────── // 鈹€鈹€ C-008: exec 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
function sanitizeCommand(cmd: string): string { function sanitizeCommand(cmd: string): string {
if (/[;&|`$(){}[\]<>!\\\n\r]/.test(cmd)) throw new Error(`Dangerous chars in: ${cmd.slice(0,50)}`); if (/[;&|`$(){}[\]<>!\\\n\r]/.test(cmd)) throw new Error(`Dangerous chars in: ${cmd.slice(0,50)}`);
return cmd; return cmd;
@@ -83,7 +83,7 @@ export async function exec(args: { command: string; cwd?: string; timeout?: numb
const command = sanitizeCommand(args.command); const command = sanitizeCommand(args.command);
const timeout = args.timeout ?? 30000; const timeout = args.timeout ?? 30000;
try { try {
const stdout = execSync(args.command, { const stdout = execSync(command, {
cwd: args.cwd ?? process.cwd(), cwd: args.cwd ?? process.cwd(),
timeout, timeout,
encoding: "utf8", encoding: "utf8",
@@ -102,7 +102,7 @@ export async function exec(args: { command: string; cwd?: string; timeout?: numb
} }
} }
// ── C-010: process_list ───────────────────────────────────── // 鈹€鈹€ C-010: process_list 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
export async function process_list(args: { export async function process_list(args: {
filter?: string; filter?: string;
}): Promise<any> { }): Promise<any> {
@@ -133,7 +133,7 @@ export async function process_list(args: {
return { count: filtered.length, processes: filtered }; return { count: filtered.length, processes: filtered };
} }
// ── C-011: sysinfo ────────────────────────────────────────── // 鈹€鈹€ C-011: sysinfo 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
export async function sysinfo(_args: {}): Promise<any> { export async function sysinfo(_args: {}): Promise<any> {
const cpuUsage = os.loadavg(); const cpuUsage = os.loadavg();
const totalMem = os.totalmem(); const totalMem = os.totalmem();