diff --git a/apps/worker/video_processing/video_compose_service.py b/apps/worker/video_processing/video_compose_service.py index 36d20f20b..9295498d7 100755 --- a/apps/worker/video_processing/video_compose_service.py +++ b/apps/worker/video_processing/video_compose_service.py @@ -17,8 +17,9 @@ from packages.domain.editing_mode import EditingMode logger = logging.getLogger(__name__) # ========== 安全常量 ========== -# 允许的输出目录白名单 -ALLOWED_OUTPUT_DIRS = ["/tmp/video_output", "/var/app/rendered"] +# 允许的输出目录白名单(使用环境变量或系统临时目录,避免硬编码 /tmp) +_VIDEO_OUTPUT_DIR = os.environ.get("VIDEO_OUTPUT_DIR", os.path.join(tempfile.gettempdir(), "video_output")) +ALLOWED_OUTPUT_DIRS = [_VIDEO_OUTPUT_DIR, "/var/app/rendered"] # 允许的输入路径前缀白名单 ALLOWED_INPUT_PREFIXES = ("s3://", "oss://", "local://", "/var/storage/") diff --git a/apps/worker/worker_app/tasks/compose_video.py b/apps/worker/worker_app/tasks/compose_video.py index c34cbb113..44baf137a 100755 --- a/apps/worker/worker_app/tasks/compose_video.py +++ b/apps/worker/worker_app/tasks/compose_video.py @@ -6,6 +6,7 @@ from __future__ import annotations import logging +import os import shutil import subprocess import tempfile @@ -73,7 +74,8 @@ def compose_video(self, job_id: str, **kwargs): # 构建合成命令 job_service.update_progress(job_id, progress=30.0, current_stage="构建 FFmpeg 命令") - output_path = f"/tmp/video_output/{job_id}.mp4" + _output_dir = os.environ.get("VIDEO_OUTPUT_DIR", os.path.join(tempfile.gettempdir(), "video_output")) + output_path = os.path.join(_output_dir, f"{job_id}.mp4") compose_cmd = compose_svc.build_compose_command(plan_id, output_path) # 执行 FFmpeg @@ -129,7 +131,8 @@ def compose_video(self, job_id: str, **kwargs): db.close() # 清理临时文件 try: - output_path = f"/tmp/video_output/{job_id}.mp4" + _output_dir = os.environ.get("VIDEO_OUTPUT_DIR", os.path.join(tempfile.gettempdir(), "video_output")) + output_path = os.path.join(_output_dir, f"{job_id}.mp4") if Path(output_path).exists(): Path(output_path).unlink() except Exception as e: