bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: address code review feedback - path traversal protection, error msg fallback, named constant 

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-03-13 05:59:53 +00:00
parent 0fb07ab66a
commit f3f4ead417
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
persona-studio/backend/brain/agent-workflow.js
View File

@ -24,6 +24,10 @@ const path = require('path');
const https = require('https');
const http = require('http');
// ── 常量 ──
// 传入 LLM 的对话文本最大字符数（防止超出模型上下文窗口）
const MAX_CONVERSATION_CHARS = 4000;
// ── 核心大脑模块 ──
const memoryManager = require('./memory-manager');
const personaEngine = require('./persona-engine');
@ -328,7 +332,7 @@ async function analyzeIntentWithLLM(brainContext, conversation, apiBase, apiKey,
model: model,
messages: [
{ role: 'system', content: systemParts.join('\n') },
{ role: 'user', content: '以下是和开发者的完整对话，请分析意图并生成开发计划：\n\n' + conversationText.substring(0, 4000) }
{ role: 'user', content: '以下是和开发者的完整对话，请分析意图并生成开发计划：\n\n' + conversationText.substring(0, MAX_CONVERSATION_CHARS) }
],
maxTokens: 2000,
temperature: 0.2,
@ -442,7 +446,8 @@ async function agentExecute(developmentPlan, devId, apiBase, apiKey, model, broa
var entries = Object.entries(files);
for (var j = 0; j < entries.length; j++) {
var safeName = path.basename(entries[j][0]);
if (!safeName || safeName.startsWith('.')) continue;
// 安全检查：防止路径遍历和隐藏文件
if (!safeName || safeName.startsWith('.') || /[/\\]/.test(entries[j][0])) continue;
fs.writeFileSync(path.join(projectDir, safeName), entries[j][1], 'utf-8');
fileList.push(safeName);
}

9
persona-studio/frontend/chat.js
View File

@ -664,9 +664,12 @@ async function confirmBuild() {
});
if (!buildRes.ok) {
var errData = {};
try { errData = await buildRes.json(); } catch (_e) { /* ignore */ }
appendMessage('system', '⚠️ 铸渊代理启动失败: ' + (errData.message || 'HTTP ' + buildRes.status));
var errMsg = 'HTTP ' + buildRes.status + ' ' + buildRes.statusText;
try {
var errData = await buildRes.json();
if (errData.message) errMsg = errData.message;
} catch (_e) { /* use status text fallback */ }
appendMessage('system', '⚠️ 铸渊代理启动失败: ' + errMsg);
updatePreviewStatus('error', '启动失败');
}
} catch (_err) {