code review 2026-07-25: 安全/正确性修复 (A1–A7) - #6
Merged
Conversation
Claude 初评 + Codex/Antigravity 交叉评审，reconcile 为 final（双方 stamp）。 Action Items 待实现。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A1 path traversal: reject unsafe username/category names (is_safe_path_segment)
+ resolve()-based containment check before write in upload.py.
A2 soft delete: guard view_report/view_category/reader with status; add DB
active-check to /raw (get_report_by_path), which never queried the DB.
A3 upload cleanup: always unlink staging zip (finally); handle BadZipFile -> 400;
clean partial extract target on error. Tests updated to expect cleanup.
A4 open redirect: only follow local relative next (is_safe_next_url; Flask-Login
0.6.3 has no url_has_allowed_host_and_scheme; also reject '/\').
A5 username casing: registration dup-check via case-insensitive get_by_login.
A6 pagination/extract bounds: clamped_page_args (lower bound + offset recompute);
cap zip member count and total uncompressed size.
A7 remove unreachable return in report_reader.
Review: docs/codereview/2026-07-25-final.md (stamped by Codex + Antigravity).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
三方 AI 评审（Claude 初评 + Codex/Antigravity 交叉评审）reconcile 成 final，双方已 stamp。本 PR 实现 final 的 Action Items。
评审文档：
docs/codereview/2026-07-25-final.md改动（按优先级）
🔴 必做
is_safe_path_segment）+upload.py落盘前resolve()containment 兜底（DATA_DIR/UPLOAD_DIR各查一次，显式abort(400)）。view_report/view_category/reader按status收口；/raw新增 DB 活跃校验（get_report_by_path，此前完全不查库）。finally无条件删暂存 zip；BadZipFile→400；失败清理解压目录；同步改测试。🟠 顺手
is_safe_next_url只放本站相对路径（含拒//与/\；Flask-Login 0.6.3 无对应 helper）。get_by_login（不区分大小写）。clamped_page_args（下界 + offset 重算）+ 解压成员数/体积上限。report_reader不可达 return。测试
104 passed（原 67 + 新增 37 条回归测试tests/test_review_fixes.py，覆盖 A1/A2/A3/A4/A5/A6）。🤖 Generated with Claude Code