xiaoxia
3b828ab184
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 2m31s
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
CI/CD Pipeline / PR Build Web Image (pull_request) Has been skipped
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 3m35s
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 3m55s
CI/CD Pipeline / Validate - Migration (alembic) (pull_request) Successful in 4m4s
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 1m56s
CI/CD Pipeline / Validate - Type Check (mypy) (pull_request) Successful in 4m31s
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 3m3s
CI/CD Pipeline / Validate - Code Quality (pull_request) Has been cancelled
CI/CD Pipeline / Unit Tests (pull_request) Has been cancelled
CI/CD Pipeline / Integration Tests (pull_request) Has been cancelled
CI/CD Pipeline / Build Production API Image (pull_request) Has been cancelled
CI/CD Pipeline / Build Production Web Image (pull_request) Has been cancelled
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been cancelled
CI/CD Pipeline / Deploy Production (pull_request) Has been cancelled
CI/CD Pipeline / Production Browser E2E (pull_request) Has been cancelled
CI/CD Pipeline / Canary Release to Production (pull_request) Has been cancelled
CI/CD Pipeline / CI Gate (pull_request) Has been cancelled
AI Code Review / AI Code Review (pull_request) Has been cancelled
PR Automation / Auto Approve on CI Green (pull_request) Has been cancelled
AI Code Review 指出的两个阻塞问题：
1. 权限校验绕过（步骤0a）：原逻辑仅在关联任务存在且
created_by_user_id 非空时才校验归属；若 GeneratedVideo 的
generation_task_id 为空或关联任务被删除，校验被静默跳过。
修复：
- 优先校验 GeneratedVideo.user_id 直接归属
- 关联任务存在时校验 task.created_by_user_id
- video 无 owner 且关联任务也查不到（归属无法确认）→ 403，
不再静默放行
2. video_url SSRF（步骤0b）：原逻辑直接使用请求体传入的 URL，
攻击者可传入内网/云元数据地址诱导服务端请求。
修复：新增 _is_trusted_media_url() 白名单校验：
- 仅允许 http/https 且主机为自家 OSS bucket/endpoint 域名
- 显式拒绝 localhost/127.*/10.*/192.168.*/169.254.*/172.16-31.*
- 校验失败静默忽略该 URL，回退后续查找链
附带改进（review 建议项）：
- 函数内联 import 全部移至模块顶部（storage/re）
- 新增 2 个安全测试：SSRF 内网地址拦截、归属无法确认 403
- 现有 32 个测试适配新的 mock 命名空间，共 34 个测试全过