sycommon-python-lib 0.2.1a6__tar.gz → 0.2.1a8__tar.gz

{sycommon_python_lib-0.2.1a6 → sycommon_python_lib-0.2.1a8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.1a6
+Version: 0.2.1a8
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.1a6 → sycommon_python_lib-0.2.1a8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.1a6"
+version = "0.2.1a8"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"

{sycommon_python_lib-0.2.1a6 → sycommon_python_lib-0.2.1a8}/src/sycommon/middleware/sandbox.py

@@ -73,20 +73,27 @@ def resolve_sandbox_path(path: str, workspace: str) -> str:
     - /skills/foo.md -> {workspace}/skills/foo.md
     - skills/foo.md -> {workspace}/skills/foo.md
 
+    如果传入的绝对路径已经在工作目录内，则直接返回。
+
     同时防止路径遍历攻击，确保解析后的路径仍在工作目录内
     """
+    # 规范化路径
+    path = os.path.normpath(path)
+    workspace = os.path.normpath(workspace)
+
+    # 如果路径已经在工作目录内，直接返回
+    if path.startswith(workspace + os.sep) or path == workspace:
+        return path
+
     # 移除开头的 / 使其成为相对路径
     if os.path.isabs(path):
-        path = path.lstrip('/')
-
-    # 规范化路径，防止 ../ 等路径遍历
-    path = os.path.normpath(path)
+        path = path.lstrip(os.sep)
 
     # 拼接到工作目录
     resolved = os.path.normpath(os.path.join(workspace, path))
 
     # 安全检查：确保最终路径在工作目录内
-    if not resolved.startswith(workspace):
+    if not resolved.startswith(workspace + os.sep) and resolved != workspace:
         raise ValueError(f"Path traversal detected: {path}")
 
     return resolved
@@ -290,6 +297,16 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
 
         SYLogger.info(f"[Sandbox Server] 执行命令: {req.command} (user={req.user_id}, timeout={req.timeout}s)")
 
+        # 创建 workspace 内的 tmp 目录，并将其设为 TMPDIR
+        workspace_tmp = os.path.join(workspace, "tmp")
+        os.makedirs(workspace_tmp, exist_ok=True)
+
+        # 设置环境变量，让脚本使用 workspace 内的 tmp 目录
+        env = os.environ.copy()
+        env["TMPDIR"] = workspace_tmp
+        env["TEMP"] = workspace_tmp
+        env["TMP"] = workspace_tmp
+
         try:
             result = subprocess.run(
                 req.command,
@@ -297,7 +314,8 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
                 capture_output=True,
                 text=True,
                 timeout=req.timeout,
-                cwd=workspace
+                cwd=workspace,
+                env=env
             )
 
             output_parts = []
@@ -379,13 +397,24 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def read_file(req: ReadRequest):
         """读取文件内容"""
         workspace = get_user_workspace(req.user_id)
+        original_path = req.file_path
+
         try:
-            file_path = resolve_sandbox_path(req.file_path, workspace)
+            file_path = resolve_sandbox_path(original_path, workspace)
         except ValueError as e:
             SYLogger.error(f"[Sandbox Server] 读取失败: {e}")
             return ReadResponse(error=str(e), content=None)
 
         if not os.path.isfile(file_path):
+            # 如果原始路径是绝对路径且存在于工作目录外，给出明确提示
+            if os.path.isabs(original_path) and os.path.isfile(original_path):
+                SYLogger.error(f"[Sandbox Server] 读取失败: 文件存在于沙箱外 {original_path}")
+                return ReadResponse(
+                    error=f"File '{original_path}' exists but is outside sandbox. "
+                          f"Try reading from sandbox path: {os.path.basename(original_path)}",
+                    content=None
+                )
+
             SYLogger.error(f"[Sandbox Server] 读取失败: 文件不存在 {file_path}")
             return ReadResponse(error=f"File '{file_path}' not found", content=None)
 

{sycommon_python_lib-0.2.1a6 → sycommon_python_lib-0.2.1a8}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.1a6
+Version: 0.2.1a8
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown