feat(workspace): 添加二进制文件安全拦截机制 (#77)#79
Merged
SunYanbox merged 1 commit intoMay 1, 2026
Merged
Conversation
- 新增功能: 实现二进制文件检测工具与扩展逻辑 * 新增 `src/utils/binary_detector.py` 模块，定义 `BINARY_EXTENSIONS` 常量集合 (包含 exe, dll, zip, png 等 100+ 扩展名) * 新增 `is_binary_file(path, encoding)` 函数，采用“扩展名匹配” + “内容解码校验”双重策略判断文件类型 * 检测逻辑支持读取前 512 字节并检查 null 字节 (`\x00`) 及 UTF-8 解码失败情况 - 修复问题: 在核心读写工具中集成二进制保护逻辑 * `read_tool.py`: 在 `read()` 方法调用 `is_binary_file` 拦截，返回明确错误提示 * `read_lines_tool.py`: 在 `read_lines()` 方法中增加相同拦截逻辑 * `write_tool.py`: 在写入前通过 `is_binary_file` 检查，阻止对 `.png`, `.exe` 或含二进制内容的文件进行覆盖 * `edit_tool.py`: 在 `edit()` 方法中增加检查，禁止修改二进制文件 * `audit_committer.py`: 在 `commit()` 流程中添加最终安全网，即使快照已批准，若检测到二进制文件则标记为 `REJECTED` - 文档更新: 补充单元测试验证防护有效性 * 新增 `tests/utils/test_binary_detector.py` 覆盖扩展名大小写、空文件、无效编码序列等边界场景 * 新增 `tests/workspace/tools/test_binary_protection.py` 验证 read/write/edit/commit 工具在遇到二进制文件时的拒绝行为 * 更新 `tests/core/test_audit_committer.py` 增加针对二进制文件提交的测试用例
SunYanbox
deleted the
77-bug-no-explicit-protection-against-reading-writing-or-editing-binary-files
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
src/utils/binary_detector.py模块，定义BINARY_EXTENSIONS常量集合 (包含 exe, dll, zip, png 等 100+ 扩展名)is_binary_file(path, encoding)函数，采用“扩展名匹配” + “内容解码校验”双重策略判断文件类型\x00) 及 UTF-8 解码失败情况read_tool.py: 在read()方法调用is_binary_file拦截，返回明确错误提示read_lines_tool.py: 在read_lines()方法中增加相同拦截逻辑write_tool.py: 在写入前通过is_binary_file检查，阻止对.png,.exe或含二进制内容的文件进行覆盖edit_tool.py: 在edit()方法中增加检查，禁止修改二进制文件audit_committer.py: 在commit()流程中添加最终安全网，即使快照已批准，若检测到二进制文件则标记为REJECTEDtests/utils/test_binary_detector.py覆盖扩展名大小写、空文件、无效编码序列等边界场景tests/workspace/tools/test_binary_protection.py验证 read/write/edit/commit 工具在遇到二进制文件时的拒绝行为tests/core/test_audit_committer.py增加针对二进制文件提交的测试用例fix #77