sycommon-python-lib 0.2.1a3__tar.gz → 0.2.1a5__tar.gz

{sycommon_python_lib-0.2.1a3 → sycommon_python_lib-0.2.1a5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.1a3
+Version: 0.2.1a5
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.1a3 → sycommon_python_lib-0.2.1a5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.1a3"
+version = "0.2.1a5"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"

{sycommon_python_lib-0.2.1a3 → sycommon_python_lib-0.2.1a5}/src/sycommon/middleware/sandbox.py

@@ -3,6 +3,21 @@
 
 提供沙箱容器的中间件和 API 路由
 支持 user_id 隔离，每个用户独立工作目录
+
+目录结构:
+    Linux (固定路径，重启后数据保留):
+        /data/sycommon_sandbox/{user_id}/
+
+    macOS/Windows (临时目录):
+        {tempdir}/sycommon_sandbox/{user_id}/
+
+    可通过环境变量 SANDBOX_WORKSPACE 覆盖默认路径
+
+路径隔离:
+    所有 API 端点使用统一路径解析 (resolve_sandbox_path):
+    - /skills/foo.md -> {workspace}/skills/foo.md
+    - skills/foo.md -> {workspace}/skills/foo.md
+    - 防止路径遍历攻击 (../../../etc/passwd)
 """
 
 import os
@@ -10,6 +25,7 @@ import subprocess
 import base64
 import shutil
 import tempfile
+import platform
 from fastapi import FastAPI, APIRouter, Request, Header
 from typing import Optional
 
@@ -20,8 +36,22 @@ from sycommon.logging.kafka_log import SYLogger
 # ============== 常量配置 ==============
 
 MAX_OUTPUT_BYTES = 100_000
-# 默认工作目录使用系统临时目录，跨平台兼容 (Windows/Linux/Mac)
-_default_workspace = os.path.join(tempfile.gettempdir(), "sycommon_sandbox")
+# 默认工作目录配置
+# - Linux: /data/sycommon_sandbox (固定路径，自动创建)
+# - macOS/Windows: 使用系统临时目录
+# 可通过环境变量 SANDBOX_WORKSPACE 覆盖
+if platform.system() == "Linux":
+    _default_workspace = "/data/sycommon_sandbox"
+    # 自动创建目录（如果不存在）
+    try:
+        os.makedirs(_default_workspace, exist_ok=True)
+    except PermissionError:
+        # 降级到临时目录
+        import tempfile
+        _default_workspace = os.path.join(tempfile.gettempdir(), "sycommon_sandbox")
+else:
+    # macOS / Windows 使用临时目录
+    _default_workspace = os.path.join(tempfile.gettempdir(), "sycommon_sandbox")
 WORKSPACE_BASE = os.environ.get("SANDBOX_WORKSPACE", _default_workspace)
 
 
@@ -35,6 +65,33 @@ def get_user_workspace(user_id: str) -> str:
     return workspace
 
 
+def resolve_sandbox_path(path: str, workspace: str) -> str:
+    """
+    将沙箱路径解析到用户工作目录，实现路径隔离
+
+    所有路径（包括绝对路径）都会映射到用户工作目录下：
+    - /skills/foo.md -> {workspace}/skills/foo.md
+    - skills/foo.md -> {workspace}/skills/foo.md
+
+    同时防止路径遍历攻击，确保解析后的路径仍在工作目录内
+    """
+    # 移除开头的 / 使其成为相对路径
+    if os.path.isabs(path):
+        path = path.lstrip('/')
+
+    # 规范化路径，防止 ../ 等路径遍历
+    path = os.path.normpath(path)
+
+    # 拼接到工作目录
+    resolved = os.path.normpath(os.path.join(workspace, path))
+
+    # 安全检查：确保最终路径在工作目录内
+    if not resolved.startswith(workspace):
+        raise ValueError(f"Path traversal detected: {path}")
+
+    return resolved
+
+
 # ============== 请求/响应模型 ==============
 
 class ExecuteRequest(BaseModel):
@@ -288,10 +345,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def ls_info(req: LsRequest):
         """列出目录内容"""
         workspace = get_user_workspace(req.user_id)
-        target_path = req.path
-
-        if not os.path.isabs(target_path):
-            target_path = os.path.join(workspace, target_path)
+        try:
+            target_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 列目录失败: {e}")
+            return []
 
         if not os.path.isdir(target_path):
             SYLogger.error(f"[Sandbox Server] 列目录失败: 目录不存在 {target_path}")
@@ -321,10 +379,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def read_file(req: ReadRequest):
         """读取文件内容"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.file_path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.file_path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 读取失败: {e}")
+            return ReadResponse(error=str(e), content=None)
 
         if not os.path.isfile(file_path):
             SYLogger.error(f"[Sandbox Server] 读取失败: 文件不存在 {file_path}")
@@ -360,10 +419,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def write_file(req: WriteRequest):
         """写入新文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.file_path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.file_path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 写入失败: {e}")
+            return WriteResponse(error=str(e), path=None)
 
         SYLogger.info(f"[Sandbox Server] 写入文件: {file_path}")
 
@@ -392,10 +452,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def edit_file(req: EditRequest):
         """编辑文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.file_path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.file_path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 编辑失败: {e}")
+            return EditResponse(error=str(e))
 
         SYLogger.info(f"[Sandbox Server] 编辑文件: {file_path}")
 
@@ -440,10 +501,10 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def upload_file(req: UploadRequest):
         """上传文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            return UploadResponse(path=req.path, error=str(e))
 
         try:
             content = base64.b64decode(req.content)
@@ -464,10 +525,10 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def download_file(req: DownloadRequest):
         """下载文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            return DownloadResponse(path=req.path, error=str(e))
 
         if not os.path.isfile(file_path):
             return DownloadResponse(path=file_path, error="file_not_found")
@@ -490,10 +551,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         import glob as glob_module
 
         workspace = get_user_workspace(req.user_id)
-        search_path = req.path
-
-        if not os.path.isabs(search_path):
-            search_path = os.path.join(workspace, search_path)
+        try:
+            search_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] glob 失败: {e}")
+            return []
 
         full_pattern = os.path.join(search_path, req.pattern)
         matches = sorted(glob_module.glob(full_pattern, recursive=True))
@@ -517,10 +579,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         import shlex
 
         workspace = get_user_workspace(req.user_id)
-        search_path = req.path or workspace
-
-        if not os.path.isabs(search_path):
-            search_path = os.path.join(workspace, search_path)
+        try:
+            search_path = resolve_sandbox_path(req.path or "/", workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] grep 失败: {e}")
+            return []
 
         quoted_path = shlex.quote(search_path)
         grep_opts = "-rHnF"

{sycommon_python_lib-0.2.1a3 → sycommon_python_lib-0.2.1a5}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.1a3
+Version: 0.2.1a5
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown