39 lines
1.1 KiB
Markdown
39 lines
1.1 KiB
Markdown
|
# 文件管理 Phase 5 审计
|
|||
|
|
|
|||
|
|
| 项 | 内容 |
|
|||
|
|
|----|------|
|
|||
|
|
| 日期 | 2026-06-01 |
|
|||
|
|
| 范围 | browse long-iso · read-file 提权 · remote_write elevation · ls 解析测试 |
|
|||
|
|
|
|||
|
|
## 改动文件清单
|
|||
|
|
|
|||
|
|
- `server/utils/unix_ls.py`
|
|||
|
|
- `server/api/sync_v2.py`
|
|||
|
|
- `server/infrastructure/ssh/asyncssh_pool.py`
|
|||
|
|
- `tests/test_file_permissions.py`
|
|||
|
|
- `tests/test_unix_ls.py`
|
|||
|
|
|
|||
|
|
## Step 3 规则扫描（H）
|
|||
|
|
|
|||
|
|
| H | 结论 | 依据 |
|
|||
|
|
|---|------|------|
|
|||
|
|
| H1 注入 | PASS | browse/read 路径仍 `normalize_remote_abs_path` + `shlex.quote` |
|
|||
|
|
| H2 提权滥用 | PASS | `remote_write_bytes` / read 仅按 `get_files_elevation`；无交互 sudo |
|
|||
|
|
| H3 信息泄露 | PASS | read 失败 stderr 截断 200 字 |
|
|||
|
|
| H4 架构分层 | PASS | 解析在 `unix_ls`；API 薄编排 |
|
|||
|
|
|
|||
|
|
## Closure
|
|||
|
|
|
|||
|
|
| 检查项 | 结果 |
|
|||
|
|
|--------|------|
|
|||
|
|
| ls 解析单测 | ✅ `test_file_permissions.py` |
|
|||
|
|
| elevation 单测 | ✅ `test_files_elevation.py` |
|
|||
|
|
| ruff | ✅ |
|
|||
|
|
| 设计 Phase 5 | ✅ |
|
|||
|
|
|
|||
|
|
## DoD
|
|||
|
|
|
|||
|
|
- [x] Phase 5 代码与测试完成
|
|||
|
|
- [x] changelog `2026-06-01-files-phase5-hardening.md`
|
|||
|
|
- [x] 批次审查表更新
|