bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: 代码审查修复 — 默认绑定127.0.0.1 + persona_id字符验证 + .env.mcp错误日志 

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/47ef90c4-eb62-4d91-9f21-475c33a7d166

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-04-07 15:17:52 +00:00 committed by GitHub
parent 25ccc35cb3
commit cb7148b897
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server/age-os/ecosystem.config.js
View File

@ -18,8 +18,10 @@ function loadEnvFile(envPath) {
env[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
}
}
} catch {
// .env.mcp 不存在时使用默认值
} catch (err) {
if (err.code !== 'ENOENT') {
console.error(`[PM2] .env.mcp 读取错误: ${err.message}`);
}
}
return env;
}

4
server/age-os/mcp-server/cos.js
View File

@ -75,6 +75,10 @@ function validatePersonaCosPath(personaId, key) {
if (!personaId || typeof personaId !== 'string') {
throw new Error('persona_id 不能为空');
}
// 验证 persona_id 仅包含安全字符（字母、数字、下划线、连字符）
if (!/^[a-zA-Z0-9_-]+$/.test(personaId)) {
throw new Error('persona_id 包含非法字符，仅允许字母、数字、下划线、连字符');
}
// 规范化：确保路径以 persona_id/ 开头
const normalizedKey = key.startsWith('/') ? key.slice(1) : key;
if (!normalizedKey.startsWith(`${personaId}/`)) {

6
server/age-os/mcp-server/server.js
View File

@ -457,9 +457,9 @@ async function logToolCall(tool, caller, status, durationMs, errorMsg) {
}
// ─── 启动 ───
// 监听 0.0.0.0 允许 Nginx 从外部反代访问
// 鉴权由 apiKeyAuth 中间件保护
const BIND_HOST = process.env.MCP_BIND_HOST || '0.0.0.0';
// 默认监听 127.0.0.1（安全默认值）
// Nginx 从本机反代访问，无需暴露到外部网络
const BIND_HOST = process.env.MCP_BIND_HOST || '127.0.0.1';
app.listen(PORT, BIND_HOST, () => {
console.log(`[MCP] AGE OS MCP Server 启动 · ${BIND_HOST}:${PORT}`);
console.log(`[MCP] 工具数量: ${Object.keys(TOOLS).length}`);