JOJO
596e781555
威胁模型：拥有普通账号的已登录用户攻击服务器。完整审计报告见
_experiments/security_audit_2026-09-02/（不入库），含实测复现记录。
严重/高危修复：
- 彻底移除文件夹打包下载（/api/download/folder 端点删除，gui/api_v1
目录下载分支改 410）：文件型符号链接会被宿主进程解析，实测可读宿主
任意文件（含 settings.json 全部 LLM 密钥），删除比补校验更彻底
- XFF 伪造防护：get_client_ip 仅信任 ASTRION_TRUSTED_PROXIES
（默认空=不信 XFF）；登录新增账号维度锁定（5 次失败锁 300s）；
注册邀请码加爆破锁定；限流桶/失败表加 2 万键上限+GC 回收
- auth_debug.log 接入大小轮转；/api/client_debug_log 加限流+长度截断
- /host-login 增加 LINUX_SAFETY 检查且仅回环地址可用
容器加固：
- 默认 cpus=1 / memory=1g，新增 pids-limit=512、memory-swap、
no-new-privileges
- 新增每用户容器配额 MAX_ACTIVE_CONTAINERS_PER_USER（默认 3），
防止单用户占满全局容器池
api_v1：
- prompts/personalizations 的 name 加白名单校验（^[A-Za-z0-9_-]{1,64}$），
修复路径穿越写入；对话元数据中的引用名同步加白名单
- workspaces/conversations/messages/upload 四端点加用户维度限流
- 消息体加 MAX_MESSAGE_CHARS 上限（默认 200000，/api/tasks 同步）
- _path_within 加分隔符边界（修复 startswith 前缀碰撞）
其他：
- SVG 预览强制 application/octet-stream（修存储型 XSS 漏网）
- monitor_snapshot 缓存键加 username 维度（修跨用户快照读取）
- ensure/delete_workspace 加 workspace_id 白名单+父目录二次核验
- delete_folder 拒绝删除工作区根（crud_mixin 与容器代理同步修）
- GuiFileManager 死代码加名称校验防复活
- admin_dashboard 静态壳非 admin 访问一律 404
- /api/app/apk/latest 加登录校验+限流（原未认证可拉 133MB）
有意未修（见报告 7.3 遗留清单）：容器 egress 过滤（部署层）、
--cap-drop ALL（怕破坏容器内工作流，已先上 no-new-privileges）、
API 用户/子智能体 LLM 按 token 计费（待产品决策）、str(exc) 收口、
WebSocket 限流、network_permission=restricted 容器语义。
验证：全部文件 py_compile 通过；冒烟测试 6/6 通过；关键新逻辑
（名称校验/路径边界/容器代理删除防护/限流回收）已单测级验证；
端点级行为待服务重启后实测复核（清单见报告 7.5）。
125 lines
3.4 KiB
Python
125 lines
3.4 KiB
Python
"""全局额度与工具限制配置。"""
|
||
|
||
import os
|
||
|
||
# 上下文与文件
|
||
MAX_CONTEXT_SIZE = 100000
|
||
MAX_FILE_SIZE = 10 * 1024 * 1024
|
||
MAX_OPEN_FILES = 20
|
||
MAX_UPLOAD_SIZE = 50 * 1024 * 1024
|
||
|
||
# 执行超时
|
||
CODE_EXECUTION_TIMEOUT = 60
|
||
TERMINAL_COMMAND_TIMEOUT = 120
|
||
SEARCH_MAX_RESULTS = 10
|
||
|
||
# 单条用户消息最大字符数（防成本攻击与内存放大；2026-09-02 安全审计新增）
|
||
MAX_MESSAGE_CHARS = int(os.environ.get("MAX_MESSAGE_CHARS", "200000") or 200000)
|
||
|
||
# 自动修复与工具调用限制（None 表示不限制）
|
||
AUTO_FIX_TOOL_CALL = False
|
||
AUTO_FIX_MAX_ATTEMPTS = 3
|
||
MAX_ITERATIONS_PER_TASK = None
|
||
MAX_CONSECUTIVE_SAME_TOOL = None
|
||
MAX_TOTAL_TOOL_CALLS = None
|
||
TOOL_CALL_COOLDOWN = 0.5
|
||
|
||
# 推理强度档位（模型配置 supports_reasoning_effort 时，思考模式下可选；None 表示默认不传参）
|
||
REASONING_EFFORT_LEVELS = ("low", "medium", "high", "xhigh", "max")
|
||
|
||
# 工具字符/体积限制
|
||
MAX_READ_FILE_CHARS = 50000
|
||
MAX_FOCUS_FILE_CHARS = 30000
|
||
MAX_RUN_COMMAND_CHARS = 50000
|
||
MAX_EXTRACT_WEBPAGE_CHARS = 80000
|
||
|
||
# read_file 子配置
|
||
READ_TOOL_MAX_FILE_SIZE = 100 * 1024 * 1024
|
||
READ_TOOL_DEFAULT_MAX_CHARS = MAX_READ_FILE_CHARS
|
||
READ_TOOL_DEFAULT_CONTEXT_BEFORE = 1
|
||
READ_TOOL_DEFAULT_CONTEXT_AFTER = 1
|
||
READ_TOOL_MAX_CONTEXT_BEFORE = 3
|
||
READ_TOOL_MAX_CONTEXT_AFTER = 5
|
||
READ_TOOL_DEFAULT_MAX_MATCHES = 5
|
||
READ_TOOL_MAX_MATCHES = 50
|
||
|
||
PROJECT_MAX_STORAGE_MB = int(os.environ.get("PROJECT_MAX_STORAGE_MB", "2048"))
|
||
PROJECT_MAX_STORAGE_BYTES = PROJECT_MAX_STORAGE_MB * 1024 * 1024
|
||
|
||
# 只读权限模式：run_command 命令白名单（启发式文本识别）。
|
||
# 注意（2026-08-30 起）：这只是「审批决策」与「兜底」的启发式，不再是安全边界——
|
||
# docker 只读由非特权 uid 内核 DAC 强制（modules/docker_readonly_exec.py），
|
||
# 宿主机只读由 OS 沙箱强制（modules/host_sandbox_runner.py）。已知可绕过
|
||
# （如 find . -delete），请勿再为它增加拦截规则试图把它做成边界。
|
||
READONLY_RUN_COMMAND_ALLOWED = (
|
||
"grep",
|
||
"find",
|
||
"ls",
|
||
"pwd",
|
||
"tree",
|
||
"cat",
|
||
"head",
|
||
"tail",
|
||
"less",
|
||
"rg",
|
||
"wc",
|
||
"du",
|
||
"stat",
|
||
"file",
|
||
"sed",
|
||
"awk",
|
||
"git",
|
||
)
|
||
READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS = (
|
||
"status",
|
||
"log",
|
||
"diff",
|
||
"show",
|
||
"branch",
|
||
"rev-parse",
|
||
)
|
||
READONLY_RUN_COMMAND_BLOCKED_TOKENS = (
|
||
"&&",
|
||
"||",
|
||
";",
|
||
"|",
|
||
">",
|
||
"<",
|
||
"$(",
|
||
"`",
|
||
)
|
||
|
||
__all__ = [
|
||
"MAX_CONTEXT_SIZE",
|
||
"MAX_FILE_SIZE",
|
||
"MAX_OPEN_FILES",
|
||
"MAX_UPLOAD_SIZE",
|
||
"CODE_EXECUTION_TIMEOUT",
|
||
"TERMINAL_COMMAND_TIMEOUT",
|
||
"SEARCH_MAX_RESULTS",
|
||
"AUTO_FIX_TOOL_CALL",
|
||
"AUTO_FIX_MAX_ATTEMPTS",
|
||
"MAX_ITERATIONS_PER_TASK",
|
||
"MAX_CONSECUTIVE_SAME_TOOL",
|
||
"MAX_TOTAL_TOOL_CALLS",
|
||
"TOOL_CALL_COOLDOWN",
|
||
"REASONING_EFFORT_LEVELS",
|
||
"MAX_READ_FILE_CHARS",
|
||
"MAX_FOCUS_FILE_CHARS",
|
||
"MAX_RUN_COMMAND_CHARS",
|
||
"MAX_EXTRACT_WEBPAGE_CHARS",
|
||
"READ_TOOL_MAX_FILE_SIZE",
|
||
"READ_TOOL_DEFAULT_MAX_CHARS",
|
||
"READ_TOOL_DEFAULT_CONTEXT_BEFORE",
|
||
"READ_TOOL_DEFAULT_CONTEXT_AFTER",
|
||
"READ_TOOL_MAX_CONTEXT_BEFORE",
|
||
"READ_TOOL_MAX_CONTEXT_AFTER",
|
||
"READ_TOOL_DEFAULT_MAX_MATCHES",
|
||
"READ_TOOL_MAX_MATCHES",
|
||
"PROJECT_MAX_STORAGE_MB",
|
||
"PROJECT_MAX_STORAGE_BYTES",
|
||
"READONLY_RUN_COMMAND_ALLOWED",
|
||
"READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS",
|
||
"READONLY_RUN_COMMAND_BLOCKED_TOKENS",
|
||
]
|