xiaoxia/xiaoxia-saas

fix: PR#312安全债务 4个P1修复（路径安全+数量上限） #322

Merged

xiaoxia merged 7 commits from fix/pr312-security-debt-p1 into develop

2026-07-14 17:43:57 +08:00

Author	SHA1	Message	Date
CI Bot	d7b37ce59a	fix: TestSubtitleFilter补work_dir参数适配新安全校验 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 32s Details CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m32s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m44s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m16s Details	2026-07-14 17:22:52 +08:00
xiaoxia	73f3334f85	style: black + isort format CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 41s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 1m31s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m13s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m8s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details	2026-07-14 17:19:45 +08:00
CI Bot	47bf6bfa5f	fix(security): #322 修复2个P1绕过漏洞 - 路径校验realpath规范化 + work_dir必填 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 17s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 1m23s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m29s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m20s Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details P1-1: 路径校验startswith绕过 - multi_track_mixer: 改用resolved_path.relative_to()替代原始字符串startswith - concat_engine: 同上 - subtitle_render_engine: 同上 - 原因: /tmp/work/../../opt/secret.aac 原始字符串以work_dir开头，旧代码误判为在目录内从而跳过白名单校验 P1-2: build_subtitle_filter work_dir默认值绕过 - work_dir=None时不再用ass_path父目录自证清白 - 不传/None/空字符串一律抛PathSecurityError - 调用方必须显式传入可信的work_dir 新增4个单测验证绕过漏洞已修复，24个测试全绿	2026-07-14 16:55:37 +08:00
xiaoxia	7e9bcbc3ae	style: black + isort format CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 20s Details CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m26s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m12s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m49s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details	2026-07-14 16:40:59 +08:00
xiaoxia	439420d44c	style: black + isort format	2026-07-14 16:40:58 +08:00
xiaoxia	4792acb5d9	style: black + isort format	2026-07-14 16:40:58 +08:00
CI Bot	63bd21c2c4	fix: PR#312安全债务 4个P1修复 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 21s Details CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m27s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m20s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m56s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details - 多轨道混音: 轨道数量上限8轨 + audio_path路径白名单校验 - 视频拼接: 段数上限50段 + video_path路径白名单校验 - 字幕渲染: subtitles滤镜路径白名单校验 + 禁止远程URL字幕 - 复用path_security.py统一安全校验模块 - 新增21个安全单元测试，52个原有测试零回归	2026-07-14 16:29:25 +08:00