bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

🛰️ [Sky-Eye Audit] address code review: email regex, log fallback, sanitize receipts, use Node.js validation 

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/8bc25538-ab95-4520-a72b-ff0d8405c7c7
This commit is contained in:
copilot-swe-agent[bot] 2026-03-24 02:14:51 +00:00
parent 6d493042c5
commit 6605d47e29
5 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/skyeye-credential-audit.yml vendored
View File

@ -16,7 +16,7 @@ name: "🛰️ 天眼密钥流审计 (Sky-Eye Credential Audit)"
on: on:
schedule: schedule:
# 每天 UTC 14:00 (CST 22:00) 执行一次审计 # 每天 UTC 14:00 (UTC+8 22:00) 执行一次审计
- cron: "0 14 * * *" - cron: "0 14 * * *"
workflow_dispatch: workflow_dispatch:

2
.github/workflows/sync-repo-to-drive.yml vendored
View File

@ -50,7 +50,7 @@ jobs:
chmod 600 "${SA_FILE}" chmod 600 "${SA_FILE}"
# 天眼密钥流校验：验证 JSON 完整性 # 天眼密钥流校验：验证 JSON 完整性
if ! python3 -c "import json,sys; json.load(open(sys.argv[1]))" "${SA_FILE}" 2>/dev/null; then if ! node -e "JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))" "${SA_FILE}" 2>/dev/null; then
echo "::error::GOOGLE_DRIVE_SERVICE_ACCOUNT contains invalid JSON (possible truncation)" echo "::error::GOOGLE_DRIVE_SERVICE_ACCOUNT contains invalid JSON (possible truncation)"
rm -f "${SA_FILE}" rm -f "${SA_FILE}"
exit 1 exit 1

2
scripts/grid-db/deploy-drive-bridge.js
View File

@ -311,7 +311,7 @@ async function deploy(commandFilePath) {
if (!validation.valid) { if (!validation.valid) {
console.error('[deploy] 🔴 Credential validation failed:'); console.error('[deploy] 🔴 Credential validation failed:');
console.error(formatDiagnosticReport(validation)); console.error(formatDiagnosticReport(validation));
writeReceipt(deploy_id, dev_id, 'failed', `Credential validation failed: ${validation.issues.join('; ')}`); writeReceipt(deploy_id, dev_id, 'failed', 'Credential validation failed: invalid service account JSON format');
return; return;
} }
credentials = validation.credentials; credentials = validation.credentials;

3
scripts/skyeye/credential-validator.js
View File

@ -146,7 +146,8 @@ function validateServiceAccountJSON(jsonStr) {
} }
if (parsed.client_email) { if (parsed.client_email) {
const emailOk = String(parsed.client_email).includes('@') && String(parsed.client_email).includes('.iam.gserviceaccount.com'); const emailStr = String(parsed.client_email);
const emailOk = /^[^@]+@[^@]+\.iam\.gserviceaccount\.com$/.test(emailStr);
result.diagnostics.field_checks.client_email_format = emailOk ? 'ok' : 'not a valid service account email'; result.diagnostics.field_checks.client_email_format = emailOk ? 'ok' : 'not a valid service account email';
if (!emailOk) result.issues.push('Field \'client_email\' does not match service account email pattern'); if (!emailOk) result.issues.push('Field \'client_email\' does not match service account email pattern');
} }

3
scripts/tcs-semantic-landing.js
View File

@ -53,7 +53,8 @@ function buildAuth(serviceAccountJson) {
console.log('[semantic-landing] ✅ Service account credentials validated'); console.log('[semantic-landing] ✅ Service account credentials validated');
} catch (err) { } catch (err) {
if (err.message === 'Service account credential validation failed') throw err; if (err.message === 'Service account credential validation failed') throw err;
// Fallback: if validator module is unavailable, try direct parse // Fallback: validator module unavailable, try direct parse
console.log('[semantic-landing] Validator unavailable, using direct JSON.parse');
credentials = JSON.parse(serviceAccountJson); credentials = JSON.parse(serviceAccountJson);
} }
return new google.auth.GoogleAuth({ return new google.auth.GoogleAuth({