@cnbcool/cnb-api-generate 2.8.2 → 2.9.1

package/client/core.ts

@@ -6,6 +6,25 @@ import { generateUniqueId } from './utils/generate-unique-id';
 import { resolveToken } from './utils/resolve-token';
 import { resolveApiDomain } from './utils/resolve-api-domain';
 
+/**
+ * 将 buffer 写入临时文件并返回文件路径
+ */
+async function writeBufferToTempFile(buffer: Buffer, extension: string, customFileName?: string): Promise<string> {
+  const tempDir = os.tmpdir();
+  const uploadDir = path.join(tempDir, 'cnb-api');
+  // recursive: true 在目录已存在时不会报错，无需先 existsSync 检查（消除 TOCTOU）
+  await fs.promises.mkdir(uploadDir, { recursive: true });
+  const fileName = customFileName || `${generateUniqueId()}${extension}`;
+  const filePath = path.join(uploadDir, fileName);
+  // 安全检查：使用 path.relative 确保最终路径不跳出 uploadDir
+  const relative = path.relative(path.resolve(uploadDir), path.resolve(filePath));
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error(`Rejected path traversal: ${fileName}`);
+  }
+  await fs.promises.writeFile(filePath, buffer);
+  return filePath;
+}
+
 /**
  * 格式化 API 响应
  * 构建包含以下字段的响应对象：
@@ -13,7 +32,7 @@ import { resolveApiDomain } from './utils/resolve-api-domain';
  * - trace: traceparent（用于调试追踪）
  * - header: 原始分页 header（x-cnb-page 等）
  * - page/pageSize/total/totalPages: 从 header 计算的分页信息（仅列表 API）
- * - data: 响应体（JSON/文本/图片路径/base64）
+ * - data: 响应体（JSON/文本/二进制文件路径）
  * 
  * 注意：所有字段始终保留，由 index.ts 的输出层决定展示哪些
  */
@@ -62,51 +81,40 @@ async function formatResponse(data: any, response: any) {
     'text/json',
   ].some((t) => contentType.includes(t));
   const isText = contentType.startsWith('text/') || contentType.includes('xml');
-  const isImage = contentType.startsWith('image/'); 
   try {
     if (isJson) {
       responseData.data = await response.json();
     } else if (isText) {
       responseData.data = await response.text();
-    } else if (isImage) {
+    } else {
+      // 非文本/JSON 响应视为二进制数据，保存到文件
       const arrayBuffer = await response.arrayBuffer();
       const buffer = Buffer.from(arrayBuffer);
 
-      // 确定文件扩展名
-      let extension = '.bin';
-      if (contentType.includes('png')) extension = '.png';
-      else if (contentType.includes('jpeg') || contentType.includes('jpg')) extension = '.jpg';
-      else if (contentType.includes('gif')) extension = '.gif';
-      else if (contentType.includes('webp')) extension = '.webp';
-      else if (contentType.includes('svg')) extension = '.svg';
-      // 可以根据需要添加更多类型
-
-      // 构建本地保存路径
-      // 注意：请确保 './downloads' 目录存在，或者使用 fs.mkdirSync 创建它
-      const tempDir = os.tmpdir();
-      const uploadDir = path.join(tempDir, 'cnb-api'); 
-      if (!fs.existsSync(uploadDir)) {
-        fs.mkdirSync(uploadDir, { recursive: true });
+      // 从下载 URL 中解析文件名(含扩展名)
+      let fileName: string | undefined;
+      try {
+        const urlObj = new URL(data.url, 'https://dummy.example');
+        const lastSegment = path.basename(urlObj.pathname);
+        if (lastSegment && lastSegment.includes('.')) {
+          let decoded = decodeURIComponent(lastSegment);
+          // 拒绝空字节（不同 OS/Node.js 版本行为不一致）
+          if (decoded.includes('\0')) throw new Error('Invalid filename: contains null byte');
+          // 只保留安全字符：字母、数字、下划线、连字符、点号
+          fileName = decoded.replace(/[^a-zA-Z0-9._-]/g, '_');
+        }
+      } catch (err) {
+        console.warn('[cnb-api] Failed to parse filename from URL:', err instanceof Error ? err.message : err);
       }
 
-      const fileName = `${generateUniqueId()}${extension}`;
-      const filePath = path.join(uploadDir, fileName);
-
-      fs.writeFileSync(filePath, buffer);
-      responseData.data = filePath;
-    } else {
-      // 其他二进制数据保持原有的 Base64 逻辑，或者也可以按需保存
-      const arrayBuffer = await response.arrayBuffer();
-      const buffer = Buffer.from(arrayBuffer);
-      const base64String = buffer.toString('base64');
-      
-      responseData.data = {
-        type: 'base64',
-        data: base64String,
-        mimeType: contentType || 'application/octet-stream',
-      };
+      if (fileName) {
+        responseData.data = await writeBufferToTempFile(buffer, '', fileName);
+      } else {
+        responseData.data = await writeBufferToTempFile(buffer, '.bin');
+      }
     }
   } catch (err: any) {
+    console.error('[cnb-api] formatResponse error:', err);
     responseData.data = err?.message || 'Unknown Error';
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cnbcool/cnb-api-generate",
-  "version": "2.8.2",
+  "version": "2.9.1",
   "main": "./built/index.js",
   "module": "./src/index.ts",
   "types": "./src/index.ts",

package/skills-template/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cnb-api
-description: CNB 平台交互命令，支持 Issue/PR 评论、提交 PR、CI 日志查询、代码仓库/制品库读写等操作。
+description: CNB 平台交互命令，支持代码仓库、Issue、PR、CI、制品库读写等操作。
 ---
 
 # cnb-api