fix: 修复 AI Code Review 的安全和稳定性问题

1. tempfile.mktemp -> NamedTemporaryFile(delete=False) - 避免 TOCTOU 竞态条件安全风险 2. subprocess.run capture_output=True -> stdout=DEVNULL, stderr=PIPE - 避免 FFmpeg 大量日志输出导致内存溢出 OOM
2026-08-20 11:28:35 +08:00
parent ffd1b0f947
commit dc3deda8d2
1 changed files with 5 additions and 2 deletions
@@ -247,7 +247,9 @@ def ingest_asset(job_id: str) -> dict:
                    )
                    _tc_tmp = None
                    try:
-                        _tc_tmp = Path(tempfile.mktemp(suffix="_h264.mp4"))
+                        _tc_tmp_file = tempfile.NamedTemporaryFile(delete=False, suffix="_h264.mp4")
+                        _tc_tmp = Path(_tc_tmp_file.name)
+                        _tc_tmp_file.close()  # 关闭文件描述符，ffmpeg 会自己打开
                        _cmd = [
                            "ffmpeg",
                            "-y",
@@ -273,7 +275,8 @@ def ingest_asset(job_id: str) -> dict:
                        ]
                        _proc = subprocess.run(
                            _cmd,
-                            capture_output=True,
+                            stdout=subprocess.DEVNULL,
+                            stderr=subprocess.PIPE,
                            text=True,
                            timeout=300,
                        )