bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: address code review feedback - path traversal protection, error msg fallback, named constant 

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-03-13 05:59:53 +00:00
parent 0fb07ab66a
commit f3f4ead417
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
persona-studio/backend/brain/agent-workflow.js
View File

@ -24,6 +24,10 @@ const path = require('path');
const https = require('https'); const https = require('https');
const http = require('http'); const http = require('http');
// ── 常量 ──
// 传入 LLM 的对话文本最大字符数（防止超出模型上下文窗口）
const MAX_CONVERSATION_CHARS = 4000;
// ── 核心大脑模块 ── // ── 核心大脑模块 ──
const memoryManager = require('./memory-manager'); const memoryManager = require('./memory-manager');
const personaEngine = require('./persona-engine'); const personaEngine = require('./persona-engine');
@ -328,7 +332,7 @@ async function analyzeIntentWithLLM(brainContext, conversation, apiBase, apiKey,
model: model, model: model,
messages: [ messages: [
{ role: 'system', content: systemParts.join('\n') }, { role: 'system', content: systemParts.join('\n') },
{ role: 'user', content: '以下是和开发者的完整对话，请分析意图并生成开发计划：\n\n' + conversationText.substring(0, 4000) } { role: 'user', content: '以下是和开发者的完整对话，请分析意图并生成开发计划：\n\n' + conversationText.substring(0, MAX_CONVERSATION_CHARS) }
], ],
maxTokens: 2000, maxTokens: 2000,
temperature: 0.2, temperature: 0.2,
@ -442,7 +446,8 @@ async function agentExecute(developmentPlan, devId, apiBase, apiKey, model, broa
var entries = Object.entries(files); var entries = Object.entries(files);
for (var j = 0; j < entries.length; j++) { for (var j = 0; j < entries.length; j++) {
var safeName = path.basename(entries[j][0]); var safeName = path.basename(entries[j][0]);
if (!safeName || safeName.startsWith('.')) continue; // 安全检查：防止路径遍历和隐藏文件
if (!safeName || safeName.startsWith('.') || /[/\\]/.test(entries[j][0])) continue;
fs.writeFileSync(path.join(projectDir, safeName), entries[j][1], 'utf-8'); fs.writeFileSync(path.join(projectDir, safeName), entries[j][1], 'utf-8');
fileList.push(safeName); fileList.push(safeName);
} }

9
persona-studio/frontend/chat.js
View File

@ -664,9 +664,12 @@ async function confirmBuild() {
}); });
if (!buildRes.ok) { if (!buildRes.ok) {
var errData = {}; var errMsg = 'HTTP ' + buildRes.status + ' ' + buildRes.statusText;
try { errData = await buildRes.json(); } catch (_e) { /* ignore */ } try {
appendMessage('system', '⚠️ 铸渊代理启动失败: ' + (errData.message || 'HTTP ' + buildRes.status)); var errData = await buildRes.json();
if (errData.message) errMsg = errData.message;
} catch (_e) { /* use status text fallback */ }
appendMessage('system', '⚠️ 铸渊代理启动失败: ' + errMsg);
updatePreviewStatus('error', '启动失败'); updatePreviewStatus('error', '启动失败');
} }
} catch (_err) { } catch (_err) {