admin/Nexus
1
0
Fork 0
Code Issues Pull Requests Actions 91 Packages Projects Releases Wiki Activity

fix: Phase 3g sync_engine_v2 bugs

Browse Source 
F3g-01 sync_commands line 195: server_results is a list; unpacking it
       with ** raises TypeError, silently caught by gather(return_exceptions=True),
       so S2 command sync and S3 config sync returned empty results for all
       servers. Fixed by using a proper dict: {"server_name": ..., "results": ...}.

F3g-02 sync_config: config value containing newline chars was not stripped
       before shlex.quote; echo inside single-quotes would write multiple lines
       to the sysctl config file, injecting arbitrary keys. Strip \n\r\x00 from
       value before quoting (requires admin auth, defense-in-depth fix).

scripts.py, settings.py: CLEAN (no changes needed).

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Your Name
2026-05-23 15:46:52 +08:00
parent 33b7ed93bf
commit c3c3bae370
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/application/services/sync_engine_v2.py
+9 -3
View File
@@ -192,7 +192,11 @@ class SyncEngineV2:
diff_summary=json.dumps(server_results),
)
sync_log = await self.sync_log_repo.create(sync_log)
results[server_id] = {**{"server_name": server.name}, **server_results, "log": _log_to_dict(sync_log)}
results[server_id] = {
"server_name": server.name,
"results": server_results,
"log": _log_to_dict(sync_log),
}
tasks = [asyncio.create_task(_exec_one(sid)) for sid in server_ids]
await asyncio.gather(*tasks, return_exceptions=True)
@@ -240,13 +244,15 @@ class SyncEngineV2:
if not re.match(r'^[a-zA-Z0-9._-]+$', str(key)):
logger.warning(f"Skipping invalid config key: {key!r}")
continue
kv_quoted = shlex.quote(f"{key}={value}")
# Strip newlines/nulls from value to prevent multi-line injection into sysctl config
safe_value = str(value).replace('\n', ' ').replace('\r', ' ').replace('\x00', '').strip()
kv_quoted = shlex.quote(f"{key}={safe_value}")
cfg_q = shlex.quote(config_path)
# Deduplicate: remove existing lines for this key before appending
commands.append(f"sed -i '/^{re.escape(key)}\\s*=/d' {cfg_q} 2>/dev/null || true")
commands.append(f"echo {kv_quoted} >> {cfg_q}")
commands.append(f"sysctl -w {kv_quoted} 2>/dev/null || true")
commands.append(f"sysctl -w {shlex.quote(f'{key}={safe_value}')} 2>/dev/null || true")
# Pre-push: backup existing config file
backup_commands = [