CI Bot
334e2b1fc2
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 16s
CI/CD Pipeline / Unit Tests (pull_request) Failing after 1m11s
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m11s
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m46s
CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
- SSRF漏接点补全：TTS 3个下载点 + BGM 3个下载点 全部接入 url_security.py 校验 - TTS: workflow.py (_transfer_audio_to_oss, _download_and_merge_segments) + streaming_service.py (_download_audio) - BGM: generation.py (外部直链, 预设库) + batch_download.py (HTTP回退) - 重定向防护：手动跟随重定向，每次跳转前重新校验目标 URL（禁用默认自动跟随） - 文件大小/类型限制：新增 safe_download_file/safe_download_bytes，流式下载 + 大小上限 + MIME 白名单 - 裸 subprocess 补齐：5 处全部改走统一 run_ffmpeg/run_ffprobe - asset_analyzer.py: 3处 (ffprobe + 2个ffmpeg) - ingest.py: 1处 (ffprobe) - voice_extraction.py: 1处 (ffmpeg) - URL安全模块迁移到 packages/shared/ 作为单一来源，worker 端保留向后兼容 re-export - 新增 run_ffprobe 统一工具函数到 ffmpeg_utils - 新增 7 个下载安全单测，累计 33 个 URL 安全测试
22 lines
637 B
Python
22 lines
637 B
Python
"""URL 安全校验工具 — SSRF 防护（向后兼容层）.
|
|
|
|
本模块为向后兼容而保留，实际实现已迁移至 packages.shared.url_security。
|
|
所有符号均从该模块重新导出，请新代码直接 import packages.shared.url_security。
|
|
"""
|
|
|
|
from packages.shared.url_security import ( # noqa: F401
|
|
ALLOWED_AUDIO_MIME_TYPES,
|
|
ALLOWED_IMAGE_MIME_TYPES,
|
|
ALLOWED_PORTS,
|
|
ALLOWED_SCHEMES,
|
|
ALLOWED_VIDEO_MIME_TYPES,
|
|
DEFAULT_MAX_DOWNLOAD_SIZE,
|
|
MAX_URL_LENGTH,
|
|
TRUSTED_DOMAINS,
|
|
UrlSecurityError,
|
|
is_url_safe,
|
|
safe_download_bytes,
|
|
safe_download_file,
|
|
validate_url_safety,
|
|
)
|