Skip to content

fix: security improvements and error handling fixes #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hobostay wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: security improvements and error handling fixes #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,14 @@
# ===== Flask 应用配置 =====
# Flask密钥（生产环境必须设置，使用随机生成的字符串）
SECRET_KEY=your_secret_key_here_generate_with_openssl_rand_hex_32
# 调试模式（生产环境应设置为False）
FLASK_DEBUG=False

# ===== CORS 配置 =====
# 允许的跨域请求来源（逗号分隔），生产环境应该明确设置
# 开发环境可以不设置，默认允许localhost和127.0.0.1的常见端口
CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000

# LLM API配置（支持 OpenAI SDK 格式的任意 LLM API）
# 推荐使用阿里百炼平台qwen-plus模型：https://bailian.console.aliyun.com/
# 注意消耗较大，可先进行小于40轮的模拟尝试
Expand Down
18 changes: 16 additions & 2 deletions backend/app/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,22 @@ def create_app(config_class=Config):
logger.info("MiroFish Backend 启动中...")
logger.info("=" * 50)

# 启用CORS
CORS(app, resources={r"/api/*": {"origins": "*"}})
# 启用CORS - 使用环境变量配置允许的来源，开发环境默认为localhost，生产环境应明确设置
allowed_origins = os.environ.get('CORS_ALLOWED_ORIGINS',
'http://localhost:3000,http://127.0.0.1:3000,http://localhost:5173,http://127.0.0.1:5173')
origins_list = [origin.strip() for origin in allowed_origins.split(',')]

# 在DEBUG模式下，如果未设置CORS_ALLOWED_ORIGINS，则允许所有本地开发端口
if debug_mode and os.environ.get('CORS_ALLOWED_ORIGINS') is None:
# 开发模式：允许本地开发服务器
CORS(app, resources={r"/api/*": {"origins": "http://localhost:*", "http://127.0.0.1:*"}})
if should_log_startup:
logger.warning("DEBUG模式: CORS配置为允许本地开发服务器（不推荐用于生产环境）")
else:
# 生产模式：只允许明确配置的来源
CORS(app, resources={r"/api/*": {"origins": origins_list}})
if should_log_startup:
logger.info(f"CORS已配置允许的来源: {origins_list}")

# 注册模拟进程清理函数（确保服务器关闭时终止所有模拟进程）
from .services.simulation_runner import SimulationRunner
Expand Down
40 changes: 17 additions & 23 deletions backend/app/api/graph.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
from ..services.text_processor import TextProcessor
from ..utils.file_parser import FileParser
from ..utils.logger import get_logger
from ..utils.error_handler import error_response, log_error
from ..models.task import TaskManager, TaskStatus
from ..models.project import ProjectManager, ProjectStatus

Expand Down Expand Up @@ -247,11 +248,8 @@ def generate_ontology():
})

except Exception as e:
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()
}), 500
log_error(logger, e, "API请求失败")
return error_response(f"请求失败: {str(e)}", 500, original_error=e)


# ============== 接口2：构建图谱 ==============
Expand Down Expand Up @@ -491,16 +489,21 @@ def wait_progress_callback(msg, progress_ratio):
# 更新项目状态为失败
build_logger.error(f"[{task_id}] 图谱构建失败: {str(e)}")
build_logger.debug(traceback.format_exc())

project.status = ProjectStatus.FAILED
project.error = str(e)
ProjectManager.save_project(project)


# Only include traceback in debug mode
error_detail = str(e)
if Config.DEBUG:
error_detail = traceback.format_exc()

task_manager.update_task(
task_id,
status=TaskStatus.FAILED,
message=f"构建失败: {str(e)}",
error=traceback.format_exc()
error=error_detail
)

# 启动后台线程
Expand All @@ -517,11 +520,8 @@ def wait_progress_callback(msg, progress_ratio):
})

except Exception as e:
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()
}), 500
log_error(logger, e, "API请求失败")
return error_response(f"请求失败: {str(e)}", 500, original_error=e)


# ============== 任务查询接口 ==============
Expand Down Expand Up @@ -582,11 +582,8 @@ def get_graph_data(graph_id: str):
})

except Exception as e:
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()
}), 500
log_error(logger, e, "API请求失败")
return error_response(f"请求失败: {str(e)}", 500, original_error=e)


@graph_bp.route('/delete/<graph_id>', methods=['DELETE'])
Expand All @@ -610,8 +607,5 @@ def delete_graph(graph_id: str):
})

except Exception as e:
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()
}), 500
log_error(logger, e, "API请求失败")
return error_response(f"请求失败: {str(e)}", 500, original_error=e)
34 changes: 17 additions & 17 deletions backend/app/api/report.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ def progress_callback(stage, progress, message):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -307,7 +307,7 @@ def get_report(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -346,7 +346,7 @@ def get_report_by_simulation(simulation_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -386,7 +386,7 @@ def list_reports():
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -432,7 +432,7 @@ def download_report(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand All @@ -458,7 +458,7 @@ def delete_report(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -555,7 +555,7 @@ def chat_with_report_agent():
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -598,7 +598,7 @@ def get_report_progress(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -649,7 +649,7 @@ def get_report_sections(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -693,7 +693,7 @@ def get_single_section(report_id: str, section_index: int):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -744,7 +744,7 @@ def check_report_status(simulation_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -805,7 +805,7 @@ def get_agent_log(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -839,7 +839,7 @@ def stream_agent_log(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -887,7 +887,7 @@ def get_console_log(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -921,7 +921,7 @@ def stream_console_log(report_id: str):
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -971,7 +971,7 @@ def search_graph_tool():
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500


Expand Down Expand Up @@ -1011,5 +1011,5 @@ def get_graph_statistics_tool():
return jsonify({
"success": False,
"error": str(e),
"traceback": traceback.format_exc()

}), 500
Loading