bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: GitHub path encoding, MCP gateway write-tool security, content preview constant 

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/2127a3a7-ea58-48a4-856c-84961107632b

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-04-04 15:24:09 +00:00 committed by GitHub
parent 3f62f770c2
commit 37a21bedf3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 31 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
server/age-os/mcp-server/github-client.js
View File

@ -86,6 +86,13 @@ function githubRequest(method, path, body) {
// 仓库内容操作
// ═══════════════════════════════════════════════════════════
/**
* 安全编码文件路径（保留斜杠，编码各段）
*/
function encodeFilePath(filePath) {
return filePath.split('/').map(segment => encodeURIComponent(segment)).join('/');
}
/**
* 读取文件内容
* @param {string} filePath - 文件路径（相对仓库根目录）
@ -94,7 +101,7 @@ function githubRequest(method, path, body) {
*/
async function readFile(filePath, ref) {
const { owner, repo } = GITHUB_CONFIG;
let apiPath = `/repos/${owner}/${repo}/contents/${encodeURIComponent(filePath)}`;
let apiPath = `/repos/${owner}/${repo}/contents/${encodeFilePath(filePath)}`;
if (ref) apiPath += `?ref=${encodeURIComponent(ref)}`;
const { data } = await githubRequest('GET', apiPath);
@ -120,7 +127,7 @@ async function readFile(filePath, ref) {
*/
async function listDirectory(dirPath, ref) {
const { owner, repo } = GITHUB_CONFIG;
const encodedPath = dirPath ? encodeURIComponent(dirPath) : '';
const encodedPath = dirPath ? encodeFilePath(dirPath) : '';
let apiPath = `/repos/${owner}/${repo}/contents/${encodedPath}`;
if (ref) apiPath += `?ref=${encodeURIComponent(ref)}`;
@ -153,7 +160,7 @@ async function listDirectory(dirPath, ref) {
*/
async function writeFile(filePath, content, message, sha, branch) {
const { owner, repo } = GITHUB_CONFIG;
const apiPath = `/repos/${owner}/${repo}/contents/${encodeURIComponent(filePath)}`;
const apiPath = `/repos/${owner}/${repo}/contents/${encodeFilePath(filePath)}`;
const body = {
message: message || `[铸渊] 更新 ${filePath}`,

4
server/age-os/mcp-server/tools/github-ops.js
View File

@ -19,6 +19,8 @@
const github = require('../github-client');
const CONTENT_PREVIEW_LENGTH = 500;
/**
* githubReadFile — 读取仓库文件内容
*
@ -36,7 +38,7 @@ async function githubReadFile(input) {
size: file.size,
sha: file.sha,
content: file.content,
content_preview: file.content.substring(0, 500) + (file.content.length > 500 ? '...' : '')
content_preview: file.content.substring(0, CONTENT_PREVIEW_LENGTH) + (file.content.length > CONTENT_PREVIEW_LENGTH ? '...' : '')
};
}

18
server/app/server.js
View File

@ -413,6 +413,15 @@ app.get('/api/mcp/health', async (_req, res) => {
});
// ─── MCP 统一工具调用（网关入口） ───
// 安全: 写操作工具需要 caller 身份标识
const MCP_WRITE_TOOLS = new Set([
'createNode', 'updateNode', 'deleteNode',
'linkNodes', 'unlinkNodes',
'cosWrite', 'cosDelete', 'cosArchive',
'notionWritePage', 'notionUpdatePage', 'notionWriteSyslog',
'githubWriteFile', 'githubTriggerDeploy'
]);
app.post('/api/mcp/call', async (req, res) => {
const { tool, input, caller } = req.body;
@ -420,6 +429,15 @@ app.post('/api/mcp/call', async (req, res) => {
return res.status(400).json({ error: true, code: 'MISSING_TOOL', message: '缺少 tool 参数' });
}
// 写操作工具需要 caller 身份标识
if (MCP_WRITE_TOOLS.has(tool) && !caller) {
return res.status(403).json({
error: true,
code: 'WRITE_REQUIRES_CALLER',
message: '写操作工具需要提供 caller 身份标识'
});
}
try {
const result = await mcpProxy('POST', '/call', { tool, input, caller: caller || 'web-gateway' });
res.status(result.statusCode).json(result.data);