From 68293eb79bc31ea2f4bf58a450e5db6523f4ef9b Mon Sep 17 00:00:00 2001
From: xiaoxia <xiaoxia@xiaoxiajianji.com>
Date: Tue, 29 Sep 2026 20:47:16 +0800
Subject: [PATCH] =?UTF-8?q?fix(worker):=20bandit/ruff=20=E5=90=88=E8=A7=84?=
 =?UTF-8?q?=EF=BC=9A=E7=94=A8=20httpx=20=E6=9B=BF=E6=8D=A2=20urllib?=
 =?UTF-8?q?=EF=BC=8Csubprocess=20=E5=8A=A0=20nosec?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/worker/viral_video/video_analyzer.py | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/apps/worker/viral_video/video_analyzer.py b/apps/worker/viral_video/video_analyzer.py
index ccab2a71b..bfce258b4 100644
--- a/apps/worker/viral_video/video_analyzer.py
+++ b/apps/worker/viral_video/video_analyzer.py
@@ -24,7 +24,7 @@ import json
 import logging
 import math
 import shutil
-import subprocess
+import subprocess  # nosec B404
 import tempfile
 import uuid
 from dataclasses import dataclass, field
@@ -134,7 +134,7 @@ def _probe_duration(video_path: str | Path) -> float:
             stderr=subprocess.DEVNULL,
             timeout=10,
             text=True,
-        )
+        )  # nosec B603
         return float(out.strip() or 0)
     except Exception as exc:  # noqa: BLE001
         logger.warning("ffprobe 时长探测失败 %s: %s", video_path, exc)
@@ -159,7 +159,7 @@ def _extract_keyframes(video_path: Path, out_dir: Path, interval: int = KEYFRAME
     ]
     subprocess.run(
         cmd_fixed, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=DEFAULT_ANALYSIS_TIMEOUT, check=False
-    )
+    )  # nosec B603
     # 场景切换帧（独立命名，scene_ 前缀）
     scene_tpl = str(out_dir / "scene_%04d.jpg")
     cmd_scene = [
@@ -177,7 +177,7 @@ def _extract_keyframes(video_path: Path, out_dir: Path, interval: int = KEYFRAME
     ]
     subprocess.run(
         cmd_scene, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=DEFAULT_ANALYSIS_TIMEOUT, check=False
-    )
+    )  # nosec B603
     frames = sorted(out_dir.glob("f_*.jpg")) + sorted(out_dir.glob("scene_*.jpg"))
     # 去重（时间点相近时 scene 帧和 fixed 帧可能重复，简单按文件名存在性保留）
     seen: set[str] = set()
@@ -332,7 +332,7 @@ def _detect_bpm(video_path: Path) -> int:
             stderr=subprocess.DEVNULL,
             timeout=20,
             check=False,
-        )
+        )  # nosec B603
         if not tmp_wav.exists() or tmp_wav.stat().st_size < 1024:
             return 0
         y, sr = librosa.load(str(tmp_wav), sr=22050, mono=True)
@@ -415,7 +415,7 @@ def _upload_frames_to_oss(frame_paths: list[Path]) -> list[str]:
                     continue
                 b64 = base64.b64encode(p.read_bytes()).decode("ascii")
                 urls.append(f"data:image/jpeg;base64,{b64}")
-            except Exception:  # noqa: BLE001
+            except Exception:  # noqa: BLE001  # nosec B112
                 continue
     return urls
 
@@ -867,11 +867,15 @@ def _ensure_local_video(reference: str, work_dir: Path) -> Optional[Path]:
         logger.warning("download_asset 失败，尝试 http 直连: %s", exc)
     if reference.startswith(("http://", "https://")):
         try:
-            import urllib.request
+            import httpx  # noqa: PLC0415 - 项目依赖，延迟导入
 
             target = work_dir / f"ref_{uuid.uuid4().hex}.mp4"
-            with urllib.request.urlopen(reference, timeout=20) as r, open(target, "wb") as f:
-                shutil.copyfileobj(r, f)
+            with httpx.Client(timeout=20.0, follow_redirects=True) as client:
+                with client.stream("GET", reference) as resp:
+                    resp.raise_for_status()
+                    with open(target, "wb") as f:
+                        for chunk in resp.iter_bytes(chunk_size=64 * 1024):
+                            f.write(chunk)
             if target.exists() and target.stat().st_size > 0:
                 return target
         except Exception as exc:  # noqa: BLE001