ooodc/PicoBot
ooodc/PicoBot
1
0
Fork 0
Code Pull Requests Activity
564 Commits 1 Branch 0 Tags
Commit Graph

5 Commits

Author SHA1 Message Date
oudecheng
1019dbe8cc refactor(code-quality): 清理 clippy 存量告警（unwrap/clone/redundant 等） 
- 移除无用克隆与冗余引用，减少不必要内存分配
- 规范 unwrap/expect 使用，修复可提前失败路径
- 修复 anthropic provider llm_timeout_secs 死代码并补全超时日志
- cargo fmt 统一格式
 2026-08-16 23:22:22 +08:00
oudecheng
58f461c953 fix: 修复 SSRF 重定向绕过 + 符号链接路径遍历 + TodoItemSummary 字段缺失 
P0: src/tools/http_request.rs SSRF 重定向绕过
  - reqwest::Client 默认跟随最多 10 次重定向，is_private_host 仅检查初始 URL
  - 攻击者可用公网 URL 返回 302 → http://127.0.0.1/ 或
    http://169.254.169.254/（云元数据端点）绕过防护访问内网
  - 修复：.redirect(reqwest::redirect::Policy::none()) 完全禁用重定向

P1: src/tools/file_read/write/edit.rs 符号链接路径遍历
  - resolve_path 用 starts_with 检查但未 canonicalize
  - 攻击者可在 allowed_dir 内创建指向 /etc/passwd 的符号链接绕过限制
  - 修复：对 resolved 和 allowed 均执行 canonicalize 后比较
  - file_read: 文件必须存在，canonicalize 失败直接报错
  - file_write/edit: 文件可能不存在，降级到父目录 canonicalize

P1: src/protocol/mod.rs + list_todos.rs TodoItemSummary 字段缺失
  - 后端 TodoItemSummary 仅返回 4 字段，前端期望 7 字段
  - 缺失 priority, created_at, updated_at，前端 TodoPanel 无法显示
    优先级和时间戳
  - 修复：struct 补齐 3 字段，list_todos 构造时传递完整字段
 2026-07-08 16:23:09 +08:00
ooodc
fc5b2a359f feat: 优化响应截断逻辑，支持多字节字符边界处理，并添加相关单元测试 2026-05-01 16:07:20 +08:00
ooodc
73dab09bfe Refactor code for improved readability and consistency 
- Adjusted formatting and indentation in various files for better clarity.
- Consolidated multi-line statements into single lines where appropriate.
- Enhanced error handling messages for better debugging.
- Added a new InboundProcessor struct to handle inbound messages more effectively.
- Updated test cases to ensure they align with the new code structure.
 2026-04-28 10:33:31 +08:00
xiaoski
1581732ef9 feat(tools): add http_request tool with security features 
- HTTP client with GET/POST/PUT/DELETE/PATCH support
- Domain allowlist for security
- SSRF protection (blocks private IPs, localhost)
- Response size limit and truncation
- Timeout control
- Includes 8 unit tests
 2026-04-07 23:49:15 +08:00