CI Bot
334e2b1fc2
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 16s
CI/CD Pipeline / Unit Tests (pull_request) Failing after 1m11s
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m11s
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m46s
CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
- SSRF漏接点补全：TTS 3个下载点 + BGM 3个下载点 全部接入 url_security.py 校验 - TTS: workflow.py (_transfer_audio_to_oss, _download_and_merge_segments) + streaming_service.py (_download_audio) - BGM: generation.py (外部直链, 预设库) + batch_download.py (HTTP回退) - 重定向防护：手动跟随重定向，每次跳转前重新校验目标 URL（禁用默认自动跟随） - 文件大小/类型限制：新增 safe_download_file/safe_download_bytes，流式下载 + 大小上限 + MIME 白名单 - 裸 subprocess 补齐：5 处全部改走统一 run_ffmpeg/run_ffprobe - asset_analyzer.py: 3处 (ffprobe + 2个ffmpeg) - ingest.py: 1处 (ffprobe) - voice_extraction.py: 1处 (ffmpeg) - URL安全模块迁移到 packages/shared/ 作为单一来源，worker 端保留向后兼容 re-export - 新增 run_ffprobe 统一工具函数到 ffmpeg_utils - 新增 7 个下载安全单测，累计 33 个 URL 安全测试