mirror of
https://ghfast.top/https://github.com/aeroxw/tick-stock-panel.git
synced 2026-09-12 17:54:15 +08:00
shy3130
697c27bb02
- 市场环境: 新增情绪周期6阶段(冰点/启动/主升/高潮/退潮/修复, 连板梯队驱动, EMA平滑+2日确认+弱档否决, 平均段长9.7天)与概念/行业主线排名(涨停梯队聚合, 可配置宽基/风格标签过滤); 市场环境页重构, regime 透明加列, 与5档state并存 - 挖掘: 因子与策略挖掘全链路(API/worker/进程锁/候选库/前端工作台/文档), 周度调度默认关闭且永不自动发布 - 回测: 财务快照因子(点时口径), 批量回测预计算共享下期收益, 信号路径矩阵列依赖展开修复(consecutive_limit_ups 缺列报错) - 数据/性能: enriched 生成与预热治理, 重任务限流, 行情/K线缓存复用, 时区修复 - 测试: 后端全量 914 通过; GUI 黑盒验证截图存证 gui-test-screenshots/
44 lines
1.4 KiB
Python
44 lines
1.4 KiB
Python
"""ExtConfigStore 的 config_id 安全校验 — 拒绝路径穿越等非法 id (fail-closed)。
|
|
|
|
删除端点的 config_id 来自 URL path 参数, 不经创建端点的 pattern 校验;
|
|
若直接拼接路径, `../victim` 可让 rmtree 删除 ext_data 之外的目录。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
|
|
from app.services.ext_data import ExtConfigStore
|
|
|
|
|
|
def _write_config(data_dir, config_id: str) -> None:
|
|
d = data_dir / "ext_data" / config_id
|
|
d.mkdir(parents=True, exist_ok=True)
|
|
(d / "config.json").write_text(
|
|
json.dumps({
|
|
"id": config_id,
|
|
"label": "测试",
|
|
"mode": "snapshot",
|
|
"fields": [{"name": "score"}],
|
|
}),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
|
|
def test_delete_rejects_path_traversal_ids(tmp_path):
|
|
store = ExtConfigStore(tmp_path)
|
|
_write_config(tmp_path, "ok_config")
|
|
|
|
# 穿越目标: ext_data 之外、含 config.json 的目录 (满足旧实现 rmtree 的前置条件)
|
|
victim = tmp_path / "victim"
|
|
victim.mkdir()
|
|
(victim / "config.json").write_text("{}", encoding="utf-8")
|
|
|
|
for bad in ("../victim", "..\\victim", "a/b", "", "."):
|
|
assert store.delete(bad) is False, bad
|
|
assert store.get(bad) is None, bad
|
|
assert (victim / "config.json").exists(), "穿越删除必须被拒绝"
|
|
|
|
# 合法 id 不受影响
|
|
assert store.get("ok_config") is not None
|
|
assert store.delete("ok_config") is True
|