xiaoxia/xiaoxia-saas

fix(security): 后端安全技术债务第二轮（P1+P2+P2） #332

Merged

xiaoxia merged 8 commits from fix/tech-debt-security-round2 into develop

2026-07-15 00:12:04 +08:00

Author	SHA1	Message	Date
xiaoxia	74730806ca	Merge branch 'develop' into fix/tech-debt-security-round2 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 42s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 1m41s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m25s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m29s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details	2026-07-15 00:09:18 +08:00
CI Bot	794191d60a	chore: re-trigger CI after merge conflict resolution	2026-07-14 22:37:35 +08:00
xiaoxia	7531739388	merge: 合并develop，解决unified_render_service和generation.py冲突 - unified_render_service: 采纳PR方案FFMPEG_BIN常量，保留str(e)[:200]截断 - generation.py: 合并两边docstring（基础SSRF校验+重定向每跳校验	2026-07-14 22:27:32 +08:00
CI Bot	abfb83e2c3	fix(test): 修复tts_segment_synthesis单测mock路径，适配audio_merger下沉run_ffmpeg CI/CD Pipeline / Unit Tests (pull_request) Successful in 2m0s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 3m6s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 3m25s Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m24s Details	2026-07-14 22:10:36 +08:00
CI Bot	4f808d4f8a	fix(ci): url_security格式化 + 修复8个单测mock路径适配 CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m12s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 2m24s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 3m20s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m28s Details - packages/shared/url_security.py: black格式化 - test_generation_p3_optimizations.py: mock从urllib.request.urlopen改为OpenerDirector.open （适配手动重定向实现，新旧实现均兼容） - test_oneclick_gen_p0_fixes.py: 同上，3个_verify_url_accessible测试	2026-07-14 20:38:29 +08:00
CI Bot	fb33b0647f	fix(ci): 修复测试import路径 + 格式化 + flake8 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 49s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 2m28s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m33s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m45s Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details - pytest.ini 添加 packages 到 pythonpath，修复 from shared.* 导入失败 - test_audio_merger_security.py: isort + black 格式化 + 修复E741模糊变量名 - test_tech_debt_security_round2.py: isort + black 格式化	2026-07-14 20:21:02 +08:00
CI Bot	f4701f7b39	fix(security): P1 audio_merger裸subprocess下沉 + ffmpeg_utils架构下沉到packages/shared CI/CD Pipeline / Unit Tests (pull_request) Failing after 36s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 41s Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 23s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m3s Details CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details - 新增 packages/shared/ffmpeg_utils.py: run_ffmpeg/FFMPEG_BIN/FFPROBE_BIN下沉到共享层 - apps/worker/video_processing/ffmpeg_utils.py: 从shared re-export，保持向后兼容 - packages/application/tts_job/audio_merger.py: 改用 shared.ffmpeg_utils.run_ffmpeg - 新增 test_audio_merger_security.py: 6个单测验证下沉正确性解决架构分层问题：application层不再需要跨层调用worker层的ffmpeg工具	2026-07-14 19:14:52 +08:00
CI Bot	0346d5ae20	fix: 安全技术债务第二轮 - 3项修复 P1: unified_render_service._extract_audio 裸subprocess下沉到ffmpeg_utils.run_ffmpeg统一管理 P2: _verify_url_accessible 手动跟随重定向，每跳URL做SSRF校验 P2: url_security 下载文件增加魔数校验（MIME白名单+文件头双重校验） - 魔数表覆盖13种常见格式（音频/视频/图片） - safe_download_file 下载完成后自动校验文件头 - 未知MIME类型跳过魔数校验（不阻断） - 配套27个单元测试全绿	2026-07-14 18:33:35 +08:00