mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-07-28 02:14:40 +00:00
3bf2d45403
* ci: add suspicious comment attachment guard Resolves #6597 * ci: reduce attachment guard false positives * ci: harden comment attachment guard * ci: tighten attachment extension matching * ci: avoid false attachment removal summary * ci: avoid markdown link attachment false positives * ci: avoid country-code attachment false positives * ci: harden attachment URL parsing * ci: reduce attachment guard false positives Updates #6597 * ci: harden malformed attachment URLs Updates #6597 * ci: reduce attachment guard overmatching Updates #6597 * ci: scan attachment path segments Updates #6597 * ci: cover review attachment summaries * ci: harden attachment link detection * fix: address critical bypass vectors in comment attachment guard - Remove break in decodeTarget catch block so malformed percent sequences (e.g., %ZZ) don't prematurely exit the decode loop, allowing double-encoded extensions to be fully detected - Strip zero-width characters (U+200B-U+200D, U+FEFF, U+00AD, U+2060, U+180E) before NFKC normalization to prevent invisible-character evasion of extension matching - Add protocol-relative URL (//) support to linkPattern and highRiskTarget, normalizing to https: before parsing - Add tests for all three bypass vectors (39 total, all passing) --------- Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com> |
||
|---|---|---|
| .. | ||
| build-and-publish-image-workflow.test.js | ||
| check-i18n.test.ts | ||
| chrome-extension-package.test.js | ||
| clean-package-build-artifacts.test.js | ||
| comment-attachment-guard-workflow.test.js | ||
| dev.test.js | ||
| generate-changelog.test.js | ||
| get-release-version-python-sdk.test.js | ||
| get-release-version.test.js | ||
| install-script.test.js | ||
| lint.test.js | ||
| no-ak-integration-ci.test.js | ||
| package-assets.test.js | ||
| package-scripts.test.js | ||
| pr-force-push-reminder-workflow.test.js | ||
| qwen-autofix-workflow.test.js | ||
| qwen-resolve-workflow.test.js | ||
| qwen-triage-workflow.test.js | ||
| release-helpers.test.js | ||
| sandbox-command.test.js | ||
| serve-fast-path-bundle-check.test.js | ||
| test-setup.ts | ||
| upload-aliyun-oss-assets.test.js | ||
| vitest.config.ts | ||
| workspaces.test.js | ||