Skip to content

merge #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 18 commits into from
Mar 26, 2025
Merged

merge #5

merged 18 commits into from
Mar 26, 2025

Conversation

@dbccccccc
Copy link
Owner

@dbccccccc dbccccccc commented Mar 26, 2025

No description provided.

dbccccccc and others added 18 commits March 26, 2025 00:05
@dbccccccc
Merge pull request #2 from dbccccccc/test
2df9086 
fix 403!
@dbccccccc
disclaimer
ec0ee1c
@dependabot
Bump requests from 2.31.0 to 2.32.2
e3dbe92 
Bumps [requests](https://github.com/psf/requests) from 2.31.0 to 2.32.2.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.31.0...v2.32.2)

---
updated-dependencies:
- dependency-name: requests
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@YuChenSSR
Update the README file, add solutions for port occupation for macOS u…
2e9471d 
…sers and solutions for different chip architectures.
@YuChenSSR
Update README_CN.md
d06c95d
@YuChenSSR
Update README.md
9e27b20
@dbccccccc
Merge pull request #3 from dbccccccc/dependabot/pip/requests-2.32.2
00d3af1 
Bump requests from 2.31.0 to 2.32.2
@dbccccccc
Merge pull request #4 from YuChenSSR/main
cbe0e8b 
Update the README file, add solutions for Mac users
@dbccccccc
project restructuring
07cf1a4
@dbccccccc
Delete .env
78579c0
@dbccccccc
docs
cdc5e2c
@dbccccccc
Update README.md
405e0db
@dbccccccc
docker update
c70c3e0
@dbccccccc
auto build
42e58d7
@dbccccccc
Update docker-build.yml
1094261
@dbccccccc
Update docker-build.yml
0f0d501
@dbccccccc
Update docker-build.yml
f80743a
@dbccccccc
feat: version display on webpage
0aa82cc
@github-advanced-security
Copy link
Contributor

github-advanced-security bot commented Mar 26, 2025

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 26, 2025
View reviewed changes
server/handlers.py
except Exception as e:
logger.error(f"Error handling request: {str(e)}")
return web.Response(
text=json.dumps({"error": str(e)}),

Check warning

Code scanning / CodeQL

Information exposure through an exception Medium

Stack trace information
Loading
flows to this location and may be exposed to an external user.

Copilot Autofix

AI 8 months ago

To fix the problem, we need to ensure that the detailed exception message is not sent back to the client. Instead, we should log the detailed error message on the server and return a generic error message to the client. This approach maintains the ability to debug issues using server logs while protecting sensitive information from being exposed to external users.

Steps to fix:

  1. Modify the exception handling block to log the detailed error message using logger.error.
  2. Return a generic error message to the client instead of the detailed exception message.
Suggested changeset 1
server/handlers.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/handlers.py b/server/handlers.py
--- a/server/handlers.py
+++ b/server/handlers.py
@@ -86,3 +86,3 @@
         return web.Response(
-            text=json.dumps({"error": str(e)}),
+            text=json.dumps({"error": "An internal error has occurred."}),
             status=500,
EOF
@@ -86,3 +86,3 @@
return web.Response(
text=json.dumps({"error": str(e)}),
text=json.dumps({"error": "An internal error has occurred."}),
status=500,
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
server/handlers.py
except Exception as e:
logger.error(f"Error processing TTS request: {str(e)}")
return web.Response(
text=json.dumps({"error": str(e)}),

Check warning

Code scanning / CodeQL

Information exposure through an exception Medium

Stack trace information
Loading
flows to this location and may be exposed to an external user.

Copilot Autofix

AI 8 months ago

To fix the problem, we should ensure that detailed exception information is not exposed to the user. Instead, we should log the detailed error message on the server and return a generic error message to the user. This approach maintains the ability to debug issues using server logs while protecting sensitive information from being exposed to potential attackers.

  1. Modify the exception handling block to log the detailed error message.
  2. Return a generic error message to the user instead of the detailed exception message.
Suggested changeset 1
server/handlers.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/handlers.py b/server/handlers.py
--- a/server/handlers.py
+++ b/server/handlers.py
@@ -169,3 +169,3 @@
             return web.Response(
-                text=json.dumps({"error": str(e)}),
+                text=json.dumps({"error": "An internal error has occurred."}),
                 status=500,
EOF
@@ -169,3 +169,3 @@
return web.Response(
text=json.dumps({"error": str(e)}),
text=json.dumps({"error": "An internal error has occurred."}),
status=500,
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
server/handlers.py
full_path = Path(__file__).parent.parent / 'static' / file_path

# Check if file exists
if not full_path.exists():

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Copilot Autofix

AI 8 months ago

To fix the problem, we need to ensure that the constructed file path is contained within a safe root directory. This can be achieved by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root directory. This will prevent any attempts to access files outside the intended directory.

  1. Normalize the full_path using os.path.normpath.
  2. Check if the normalized full_path starts with the intended root directory.
  3. If the check fails, raise an exception or return a 403 Forbidden response.
Suggested changeset 1
server/handlers.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/handlers.py b/server/handlers.py
--- a/server/handlers.py
+++ b/server/handlers.py
@@ -209,6 +209,12 @@
         # Construct full path - look in static directory
-        full_path = Path(__file__).parent.parent / 'static' / file_path
+        base_path = Path(__file__).parent.parent / 'static'
+        full_path = base_path / file_path
+        normalized_full_path = full_path.resolve()
+        
+        # Check if the normalized path is within the base path
+        if not str(normalized_full_path).startswith(str(base_path)):
+            return web.Response(text="Forbidden", status=403)
         
         # Check if file exists
-        if not full_path.exists():
+        if not normalized_full_path.exists():
             return web.Response(text="Not found", status=404)
EOF
@@ -209,6 +209,12 @@
# Construct full path - look in static directory
full_path = Path(__file__).parent.parent / 'static' / file_path
base_path = Path(__file__).parent.parent / 'static'
full_path = base_path / file_path
normalized_full_path = full_path.resolve()

# Check if the normalized path is within the base path
if not str(normalized_full_path).startswith(str(base_path)):
return web.Response(text="Forbidden", status=403)

# Check if file exists
if not full_path.exists():
if not normalized_full_path.exists():
return web.Response(text="Not found", status=404)
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
server/handlers.py
return web.Response(text="Not found", status=404)

# Read file
with open(full_path, 'rb') as f:

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Copilot Autofix

AI 8 months ago

To fix the problem, we need to ensure that the constructed file path is contained within a safe root directory. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root directory. This will prevent path traversal attacks and ensure that only files within the designated static directory can be accessed.

  1. Normalize the full_path using os.path.normpath.
  2. Check that the normalized full_path starts with the static directory path.
  3. If the check fails, return a 403 Forbidden response.
Suggested changeset 1
server/handlers.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/handlers.py b/server/handlers.py
--- a/server/handlers.py
+++ b/server/handlers.py
@@ -209,6 +209,12 @@
         # Construct full path - look in static directory
-        full_path = Path(__file__).parent.parent / 'static' / file_path
+        static_dir = Path(__file__).parent.parent / 'static'
+        full_path = static_dir / file_path
+        normalized_full_path = full_path.resolve()
+        
+        # Ensure the path is within the static directory
+        if not str(normalized_full_path).startswith(str(static_dir)):
+            return web.Response(text="Forbidden", status=403)
         
         # Check if file exists
-        if not full_path.exists():
+        if not normalized_full_path.exists():
             return web.Response(text="Not found", status=404)
EOF
@@ -209,6 +209,12 @@
# Construct full path - look in static directory
full_path = Path(__file__).parent.parent / 'static' / file_path
static_dir = Path(__file__).parent.parent / 'static'
full_path = static_dir / file_path
normalized_full_path = full_path.resolve()

# Ensure the path is within the static directory
if not str(normalized_full_path).startswith(str(static_dir)):
return web.Response(text="Forbidden", status=403)

# Check if file exists
if not full_path.exists():
if not normalized_full_path.exists():
return web.Response(text="Not found", status=404)
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
server/handlers.py

except Exception as e:
logger.error(f"Error serving static file: {str(e)}")
return web.Response(text=str(e), status=500) No newline at end of file

Check warning

Code scanning / CodeQL

Information exposure through an exception Medium

Stack trace information
Loading
flows to this location and may be exposed to an external user.

Copilot Autofix

AI 8 months ago

To fix the problem, we should replace the detailed error message returned to the user with a generic error message. The detailed error message should be logged on the server for debugging purposes. This approach ensures that sensitive information is not exposed to external users while still allowing developers to access the necessary details for troubleshooting.

  1. Modify the exception handling block in the handle_static function to return a generic error message instead of str(e).
  2. Ensure that the detailed error message is logged on the server.
Suggested changeset 1
server/handlers.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/handlers.py b/server/handlers.py
--- a/server/handlers.py
+++ b/server/handlers.py
@@ -243,2 +243,2 @@
         logger.error(f"Error serving static file: {str(e)}")
-        return web.Response(text=str(e), status=500) 
\ No newline at end of file
+        return web.Response(text="An internal error has occurred.", status=500)
\ No newline at end of file
EOF
@@ -243,2 +243,2 @@
logger.error(f"Error serving static file: {str(e)}")
return web.Response(text=str(e), status=500)
return web.Response(text="An internal error has occurred.", status=500)
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
static/index.html
<link rel="stylesheet" href="styles.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism-tomorrow.min.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
static/index.html
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism-tomorrow.min.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-python.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
static/index.html
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-python.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-json.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
static/index.html
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-python.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-json.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-javascript.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
@dbccccccc dbccccccc merged commit 4586930 into test Mar 26, 2025
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dbccccccc @YuChenSSR