Skip to content

Commit c1550b4

Browse files
AgionsAgions
committed
fix: resolve command injection vulnerability (CWE-78)
Security fixes: - handlers.ts: Validate tool name against registry before execution - Prevents calling hidden/unregistered tools like terminal_execute - Returns error for unregistered tool attempts - executor.ts: Prevent shell metacharacter injection - Block shell metacharacters: ; & | ` $ ( ) { } [ ] < > \ ! * ? - Block command substitution patterns - Use shell: false in execSync to disable shell interpretation Fixes #2
0 parents  commit c1550b4

File tree

368 files changed

+82250
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

368 files changed

+82250
-0
lines changed

‎.editorconfig‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# EditorConfig is awesome: https://EditorConfig.org
2+
3+
# Top-most EditorConfig file
4+
root = true
5+
6+
# Unix-style newlines with a newline ending every file
7+
[*]
8+
end_of_line = lf
9+
insert_final_newline = true
10+
charset = utf-8
11+
trim_trailing_whitespace = true
12+
13+
# TypeScript, JavaScript, JSON
14+
[*.{ts,tsx,js,jsx,json}]
15+
indent_style = space
16+
indent_size = 2
17+
18+
# Markdown
19+
[*.md]
20+
trim_trailing_whitespace = false
21+
22+
# YAML
23+
[*.{yml,yaml}]
24+
indent_style = space
25+
indent_size = 2
26+
27+
# Shell scripts
28+
[*.sh]
29+
indent_style = space
30+
indent_size = 2
31+
32+
# Package files
33+
[{package.json,*.yml}]
34+
indent_style = space
35+
indent_size = 2

‎.env.example‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# TaskFlow AI 环境变量配置示例
2+
# 复制此文件为 .env 并填入您的真实API密钥
3+
4+
# ===========================================
5+
# AI模型配置 (必填至少一个)
6+
# ===========================================
7+
8+
# DeepSeek AI 配置
9+
DEEPSEEK_API_KEY=sk-your_deepseek_api_key_here
10+
11+
# 百度文心一言配置
12+
BAIDU_API_KEY=your_baidu_api_key_here
13+
BAIDU_SECRET_KEY=your_baidu_secret_key_here
14+
15+
# 智谱AI配置
16+
ZHIPU_API_KEY=your_zhipu_api_key_here
17+
18+
# OpenRouter配置
19+
OPENROUTER_API_KEY=your_openrouter_api_key_here
20+
21+
# 讯飞星火配置
22+
XUNFEI_APP_ID=your_xunfei_app_id_here
23+
XUNFEI_API_KEY=your_xunfei_api_key_here
24+
XUNFEI_API_SECRET=your_xunfei_api_secret_here
25+
26+
# 阿里通义千问配置
27+
QWEN_API_KEY=your_qwen_api_key_here
28+
29+
# 月之暗面Kimi配置
30+
MOONSHOT_API_KEY=your_moonshot_api_key_here
31+
32+
# ===========================================
33+
# 应用配置
34+
# ===========================================
35+
36+
# 环境配置
37+
NODE_ENV=development
38+
LOG_LEVEL=info
39+
40+
41+
42+
# 数据存储配置
43+
DATA_DIR=./data
44+
BACKUP_DIR=./backups
45+
46+
# ===========================================
47+
# 性能与监控配置
48+
# ===========================================
49+
50+
# 性能监控配置
51+
ENABLE_PERFORMANCE_MONITORING=true
52+
PERFORMANCE_LOG_INTERVAL=60000
53+
54+
# 安全配置
55+
ENABLE_RATE_LIMITING=true
56+
MAX_REQUESTS_PER_MINUTE=100
57+
58+
# ===========================================
59+
# 开发配置 (可选)
60+
# ===========================================
61+
62+
# 调试模式
63+
DEBUG=taskflow:*
64+
65+
# 测试配置
66+
TEST_TIMEOUT=30000
67+
TEST_PARALLEL=true
68+
69+
# 构建配置
70+
BUILD_ANALYZE=false
71+
BUILD_SOURCEMAP=true
72+
73+
74+
VERSION=
75+
76+
# ===========================================
77+
# MCP 服务器配置
78+
# ===========================================
79+
80+
# MCP传输协议 (stdio, http)
81+
MCP_TRANSPORT=stdio
82+
83+
# MCP HTTP端口 (仅在http模式下使用)
84+
MCP_PORT=3001
85+
86+
# MCP服务器环境
87+
TASKFLOW_ENV=production
88+
89+
# ===========================================
90+
# 容器化部署配置
91+
# ===========================================
92+
93+
# 应用环境
94+
NODE_ENV=production
95+
96+
# 日志级别
97+
LOG_LEVEL=info
98+
99+
# 数据目录
100+
TASKFLOW_DATA_DIR=/app/data
101+
TASKFLOW_LOG_DIR=/app/logs
102+
TASKFLOW_CONFIG_DIR=/app/config
103+
104+
# 并发限制
105+
TASKFLOW_MAX_CONCURRENT_TASKS=10
106+
107+
# 内存限制 (MB)
108+
TASKFLOW_MEMORY_LIMIT=1024

‎.eslintrc.cjs‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
module.exports = {
2+
parser: '@typescript-eslint/parser',
3+
extends: [
4+
'eslint:recommended',
5+
'plugin:@typescript-eslint/recommended',
6+
],
7+
plugins: ['@typescript-eslint'],
8+
parserOptions: {
9+
ecmaVersion: 2021,
10+
sourceType: 'module',
11+
},
12+
env: {
13+
node: true,
14+
jest: true,
15+
es6: true,
16+
},
17+
rules: {
18+
'@typescript-eslint/explicit-function-return-type': 'off',
19+
'@typescript-eslint/explicit-module-boundary-types': 'off',
20+
'@typescript-eslint/no-explicit-any': 'off',
21+
'@typescript-eslint/no-unused-vars': 'off',
22+
'@typescript-eslint/no-empty-function': 'off',
23+
'@typescript-eslint/no-require-imports': 'off',
24+
'@typescript-eslint/no-unsafe-function-type': 'off',
25+
'@typescript-eslint/no-unsafe-call': 'off',
26+
'@typescript-eslint/no-unsafe-member-access': 'off',
27+
'@typescript-eslint/no-unsafe-return': 'off',
28+
'@typescript-eslint/no-unsafe-assignment': 'off',
29+
'@typescript-eslint/no-unused-expressions': 'off',
30+
'no-console': 'off',
31+
'no-unused-vars': 'off',
32+
'prefer-const': 'off',
33+
'no-var': 'off',
34+
'eqeqeq': 'off',
35+
'no-empty': 'off',
36+
},
37+
ignorePatterns: ['dist', 'node_modules', 'coverage', '*.js', '*.d.ts'],
38+
};

‎.gitattributes‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Binary files
2+
*.7z binary
3+
*.bmp binary
4+
*.deb binary
5+
*.dmg binary
6+
*.ear binary
7+
*.gif binary
8+
*.gz binary
9+
*.jar binary
10+
*.jpeg binary
11+
*.jpg binary
12+
*.png binary
13+
*.rar binary
14+
*.rpm binary
15+
*.svg text
16+
*.tar binary
17+
*.tgz binary
18+
*.war binary
19+
*.webp binary
20+
*.woff binary
21+
*.woff2 binary
22+
*.zip binary
23+
24+
# Images
25+
assets/** binary
26+
27+
# Docs
28+
docs/.vitepress/cache/** binary
29+
docs/.vitepress/dist/** binary
30+
31+
# Build outputs
32+
dist/** binary
33+
34+
# Dependencies
35+
node_modules/** binary
36+
37+
# Test coverage
38+
coverage/** binary

‎.github/workflows/deploy-docs.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Deploy Documentation
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'docs/**'
9+
- '.github/workflows/deploy-docs.yml'
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
pages: write
15+
id-token: write
16+
17+
concurrency:
18+
group: pages
19+
cancel-in-progress: false
20+
21+
jobs:
22+
build:
23+
name: Build Documentation
24+
runs-on: ubuntu-latest
25+
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
with:
30+
fetch-depth: 0
31+
32+
- name: Setup Node.js
33+
uses: actions/setup-node@v4
34+
with:
35+
node-version: '20'
36+
37+
- name: Setup pnpm
38+
uses: pnpm/action-setup@v4
39+
with:
40+
version: 10
41+
42+
- name: Get pnpm store directory
43+
shell: bash
44+
run: |
45+
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
46+
47+
- name: Setup pnpm cache
48+
uses: actions/cache@v4
49+
with:
50+
path: ${{ env.STORE_PATH }}
51+
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
52+
restore-keys: |
53+
${{ runner.os }}-pnpm-store-
54+
55+
- name: Install dependencies
56+
run: |
57+
cd docs
58+
pnpm install --no-frozen-lockfile
59+
60+
- name: Build documentation
61+
run: |
62+
cd docs
63+
pnpm run build
64+
env:
65+
NODE_ENV: production
66+
67+
- name: Upload artifact
68+
uses: actions/upload-pages-artifact@v3
69+
with:
70+
path: docs/.vitepress/dist
71+
72+
deploy:
73+
name: Deploy to GitHub Pages
74+
needs: build
75+
runs-on: ubuntu-latest
76+
permissions:
77+
pages: write
78+
id-token: write
79+
contents: read
80+
81+
environment:
82+
name: github-pages
83+
url: ${{ steps.deployment.outputs.page_url }}
84+
85+
steps:
86+
- name: Deploy to GitHub Pages
87+
id: deployment
88+
uses: actions/deploy-pages@v4

‎.github/workflows/npm-publish.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Publish to NPM
2+
3+
on:
4+
release:
5+
types: [published]
6+
workflow_dispatch:
7+
inputs:
8+
version:
9+
description: 'Version to publish (e.g., 2.1.7)'
10+
required: false
11+
type: string
12+
13+
jobs:
14+
publish:
15+
name: Publish to npm
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
packages: write
20+
id-token: write
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v4
24+
25+
- name: Setup Node.js
26+
uses: actions/setup-node@v4
27+
with:
28+
node-version: '22'
29+
registry-url: 'https://registry.npmjs.org'
30+
31+
- name: Install pnpm
32+
uses: pnpm/action-setup@v4
33+
with:
34+
version: 9
35+
36+
- name: Get pnpm store directory
37+
shell: bash
38+
run: |
39+
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
40+
41+
- name: Setup pnpm cache
42+
uses: actions/cache@v4
43+
with:
44+
path: ${{ env.STORE_PATH }}
45+
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
46+
restore-keys: |
47+
${{ runner.os }}-pnpm-store-
48+
49+
- name: Install dependencies
50+
run: pnpm install --frozen-lockfile
51+
52+
- name: Type check
53+
run: pnpm run type-check
54+
55+
- name: Lint
56+
run: pnpm run lint
57+
58+
- name: Format check
59+
run: pnpm run format:check
60+
61+
- name: Test
62+
run: pnpm run test
63+
64+
- name: Build
65+
run: pnpm run build
66+
67+
- name: Update version
68+
if: github.event_name == 'workflow_dispatch' && github.event.inputs.version != ''
69+
run: |
70+
CURRENT_VERSION=$(node -p "require('./package.json').version")
71+
if [ "$CURRENT_VERSION" != "${{ github.event.inputs.version }}" ]; then
72+
pnpm version ${{ github.event.inputs.version }} --no-git-tag-version
73+
else
74+
echo "Version $CURRENT_VERSION already matches target, skipping update"
75+
fi
76+
77+
- name: Publish to npm
78+
run: npm publish --access public
79+
env:
80+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

0 commit comments

Comments
 (0)