wunianxiao/iAs
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 5 个安全/正确性问题（第二轮）

Browse Source 
1. (High) user_id NOT NULL 导致 add 任务失败
   → ALTER TABLE 加 DEFAULT '', DROP NOT NULL
2. (High) 调度器任务卡住阻塞后续
   → timeout(120s) + kill_on_drop
3. (Medium) 多实例重复执行
   → SELECT ... FOR UPDATE SKIP LOCKED
4. (Medium) SQL 注入（字符串拼接）
   → psql -v 参数化 (:name, :cmd, :interval)
5. (Medium) 非工具对话 usage 未记录
   → consume() 改为 &mut self，消费后再读 usage
This commit is contained in:
无念晓
2026-06-02 11:03:31 +08:00
parent 5602b08faf
commit 6dd12425d6
5 changed files with 33 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resources/skills/manage_scheduled_task/scripts/manage.sh
+8 -7
View File
@@ -1,5 +1,5 @@
#!/bin/bash
# 管理定时任务 → JSON 输出
# 管理定时任务 → JSON 输出（参数化查询）
read -r input
ACTION=$(echo "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('action',''))" 2>/dev/null)
NAME=$(echo "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('name',''))" 2>/dev/null)
@@ -14,22 +14,23 @@ DB_URL="${DATABASE_URL}"
case "$ACTION" in
add)
[ -z "$CMD" ] && echo '{"error":"add 需要 command 参数"}' && exit 0
psql "$DB_URL" -c "
psql "$DB_URL" -v name="$NAME" -v desc="$DESC" -v cmd="$CMD" -v interval="$INTERVAL" << 'SQL'
INSERT INTO scheduled_tasks (id, name, description, command, interval_seconds, enabled, next_run_at)
VALUES (gen_random_uuid(), '$NAME', '$DESC', '$CMD', $INTERVAL, true, NOW() + interval '$INTERVAL seconds')
VALUES (gen_random_uuid(), :'name', :'desc', :'cmd', :interval, true, NOW() + interval ':interval seconds')
ON CONFLICT (name) DO UPDATE SET command=EXCLUDED.command, interval_seconds=EXCLUDED.interval_seconds, enabled=true, description=EXCLUDED.description
" 2>/dev/null && echo '{"ok":true,"action":"add","name":"'"$NAME"'"}' || echo '{"error":"添加失败"}'
SQL
echo '{"ok":true,"action":"add","name":"'"$NAME"'"}'
;;
delete)
psql "$DB_URL" -c "DELETE FROM scheduled_tasks WHERE name = '$NAME'" 2>/dev/null
psql "$DB_URL" -v name="$NAME" -c "DELETE FROM scheduled_tasks WHERE name = :'name'" 2>/dev/null
echo '{"ok":true,"action":"delete","name":"'"$NAME"'"}'
;;
enable)
psql "$DB_URL" -c "UPDATE scheduled_tasks SET enabled = true WHERE name = '$NAME'" 2>/dev/null
psql "$DB_URL" -v name="$NAME" -c "UPDATE scheduled_tasks SET enabled = true WHERE name = :'name'" 2>/dev/null
echo '{"ok":true,"action":"enable","name":"'"$NAME"'"}'
;;
disable)
psql "$DB_URL" -c "UPDATE scheduled_tasks SET enabled = false WHERE name = '$NAME'" 2>/dev/null
psql "$DB_URL" -v name="$NAME" -c "UPDATE scheduled_tasks SET enabled = false WHERE name = :'name'" 2>/dev/null
echo '{"ok":true,"action":"disable","name":"'"$NAME"'"}'
;;
*)