Skip to content

(Don't Merge)Nekobrawl arena v2 #1454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
rophec wants to merge 18 commits into
base: main
Choose a base branch
from
Draft

(Don't Merge)Nekobrawl arena v2 #1454

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
5dc24ce
NekoBattleArenaV2
rophec May 21, 2026
6c6094c
Merge branch 'Project-N-E-K-O:main' into NekoBrawlArenaV2
rophec May 21, 2026
b52144e
Merge remote-tracking branch 'upstream/main' into NekoBrawlArenaV2
rophec May 23, 2026
9c2b35d
feat: update neko brawl arena prototype
rophec May 24, 2026
43259f8
Merge branch 'main' into NekoBrawlArenaV2
rophec May 24, 2026
e9d359c
fix: make deck builder card collection scrollable
rophec May 24, 2026
718f0b8
fix: limit forged cards to single deck copy
rophec May 24, 2026
bd1331b
fix: refine forged card story prompt perspective
rophec May 24, 2026
b308b56
feat: expand neko brawl arena prototype
rophec May 26, 2026
ee64a77
Merge branch 'Project-N-E-K-O:main' into NekoBrawlArenaV2
rophec May 26, 2026
62615da
Merge branch 'NekoBrawlArenaV2' of https://github.com/rophec/N.E.K.O …
rophec May 26, 2026
c84df69
docs: add neko brawl exploration rules
rophec May 27, 2026
f1d92b3
Merge remote-tracking branch 'upstream/main' into draft
rophec May 27, 2026
d0599ff
feat(neko-brawl): 探险五类落点交互实装 + 移除战斗触发卡
LyaQanYi May 29, 2026
47130b5
docs(neko-brawl): 同步探险交互实现状态 + 新增改动总览
LyaQanYi May 29, 2026
32292ae
fix(neko-brawl): 处理 PR review 的 6 条意见
LyaQanYi May 29, 2026
3086b8e
Merge branch 'main' into NekoBrawlArenaV2
LyaQanYi May 29, 2026
02a84ab
Merge remote-tracking branch 'upstream/main' into NekoBrawlArenaV2
rophec Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ Cargo.lock

# Node/Front-end temp (if any)
node_modules/
.vite/
*.cache/
*.tsbuildinfo
dist/
Expand Down
33 changes: 33 additions & 0 deletions app/main_server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ def _get_app_root():
from fastapi import FastAPI, Request # noqa
from fastapi.responses import JSONResponse # noqa
from fastapi.staticfiles import StaticFiles # noqa
from fastapi.middleware.cors import CORSMiddleware # noqa
from main_logic import core as core, cross_server as cross_server # noqa
from main_logic.agent_event_bus import MainServerAgentBridge, notify_analyze_ack, set_main_bridge # noqa
from fastapi.templating import Jinja2Templates # noqa
Expand Down Expand Up @@ -1365,6 +1366,15 @@ async def remove_one_catgirl(name: str):
# --- FastAPI App Setup ---
app = FastAPI()

# 允许 battle-arena 前端及其他跨域来源访问头像同步端点
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
)

_main_runtime_limited_mode_enabled = False
_main_runtime_limited_mode_reason = ""
_MAIN_LIMITED_MODE_ALLOWED_EXACT_PATHS = {
Expand Down Expand Up @@ -1594,6 +1604,29 @@ async def beacon_shutdown():
logger.error(f"Beacon处理错误: {e}")
return {"success": False, "error": str(e)}

# ── Battle-Arena 跨域头像同步端点 ────────────────────────────────
_battle_arena_avatars: dict = {} # side -> {dataUrl, name}


@app.post('/battle-arena/avatar')
async def set_battle_avatar(payload: dict):
"""由 app-chat-avatar.js 在捕获头像后调用，存储 dataUrl 和角色名供 battle-arena 获取。"""
side = str(payload.get('side', 'left'))
data_url = str(payload.get('dataUrl', ''))
name = str(payload.get('name', ''))
if data_url:
_battle_arena_avatars[side] = {'dataUrl': data_url, 'name': name}
return {"ok": True}


@app.get('/battle-arena/avatar/{side}')
async def get_battle_avatar(side: str):
"""battle-arena 前端轮询此端点获取最新头像 dataUrl 和角色名。"""
from fastapi.responses import JSONResponse
entry = _battle_arena_avatars.get(side, {})
return JSONResponse({'dataUrl': entry.get('dataUrl', ''), 'name': entry.get('name', '')})
Comment on lines +1662 to +1678
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

头像同步端点缺少输入边界，容易被超大 dataUrl 或任意 side 撑爆内存喵。

Line [1601-1606] 直接把外部 side/dataUrl/name 入内存，没有 side 白名单、格式校验和长度上限喵。建议最少限制 side（left/right）并限制 dataUrl 前缀与长度（超限返回 4xx）喵。

💡 建议修复（示例） 
 _battle_arena_avatars: dict = {}  # side -> {dataUrl, name}
+_BATTLE_AVATAR_SIDES = {"left", "right"}
+_BATTLE_AVATAR_MAX_DATA_URL_LEN = 2_000_000

 `@app.post`('/battle-arena/avatar')
 async def set_battle_avatar(payload: dict):
@@
-    side = str(payload.get('side', 'left'))
+    side = str(payload.get('side', 'left')).strip()
     data_url = str(payload.get('dataUrl', ''))
     name = str(payload.get('name', ''))
-    if data_url:
+    if side not in _BATTLE_AVATAR_SIDES:
+        return JSONResponse(status_code=400, content={"ok": False, "error": "invalid side"})
+    if data_url and (not data_url.startswith("data:image/") or len(data_url) > _BATTLE_AVATAR_MAX_DATA_URL_LEN):
+        return JSONResponse(status_code=413, content={"ok": False, "error": "avatar too large or invalid"})
+    if data_url:
         _battle_arena_avatars[side] = {'dataUrl': data_url, 'name': name}
     return {"ok": True}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/main_server.py` around lines 1598 - 1614, The set_battle_avatar and
get_battle_avatar endpoints currently accept untrusted side/dataUrl/name into
_battle_arena_avatars; add input validation and bounds: enforce side whitelist
(only "left" or "right") in both set_battle_avatar and get_battle_avatar,
validate dataUrl starts with an allowed prefix like "data:image/" and cap its
length (e.g. max bytes/chars) and similarly cap name length; if validation fails
return a 4xx response (e.g. 400) instead of storing; ensure you reference and
update _battle_arena_avatars only after passing these checks so oversized or
invalid payloads cannot exhaust memory.



# 挂载全部路由
app.include_router(config_router)
app.include_router(proactive_router)
Expand Down
12 changes: 12 additions & 0 deletions battle-arena/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<!doctype html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>猫娘大乱斗 · Nekoverse</title>
</head>
<body>
<div id="root"></div>
<script type="module" src="/src/main.jsx"></script>
</body>
</html>
Loading
Loading