From 3b5f728efe6d237d8db1f0d639854cb0dc4b8055 Mon Sep 17 00:00:00 2001 From: starmen1265 Date: Mon, 9 Mar 2026 15:18:22 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=89=E5=85=A8=E4=BF=AE=E5=A4=8D(High):=20?= =?UTF-8?q?=E6=96=87=E4=BB=B6=E5=88=9B=E5=BB=BA=E6=97=B6=E8=AE=BE=E7=BD=AE?= =?UTF-8?q?=E6=9D=83=E9=99=90=200o600?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 锁文件创建时设置权限 0o600 - 临时文件创建时设置权限 0o600 - 数据文件写入后确保权限为 0o600 - 防止未授权访问敏感统计数据 --- agents/haonan/workspace/dev-workflow/stats.py | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/agents/haonan/workspace/dev-workflow/stats.py b/agents/haonan/workspace/dev-workflow/stats.py index a86e366..ad931e5 100644 --- a/agents/haonan/workspace/dev-workflow/stats.py +++ b/agents/haonan/workspace/dev-workflow/stats.py @@ -45,7 +45,9 @@ def _acquire_lock(lock_file_path: Path): """ try: lock_file_path.parent.mkdir(parents=True, exist_ok=True) - lock_fd = open(lock_file_path, 'w') + # 使用 os.open 创建文件并设置权限 + fd = os.open(lock_file_path, os.O_WRONLY | os.O_CREAT, 0o600) + lock_fd = os.fdopen(fd, 'w') fcntl.flock(lock_fd.fileno(), fcntl.LOCK_EX) return lock_fd except (OSError, IOError) as e: @@ -116,19 +118,22 @@ def _atomic_write(data: Dict[str, Any]): try: lock_fd = _acquire_lock(LOCK_FILE) - # 写入临时文件 - with tempfile.NamedTemporaryFile( - mode='w', - encoding='utf-8', - dir=STATS_DIR, - suffix='.tmp', - delete=False - ) as temp_file: + # 写入临时文件（使用 os.open 设置权限） + fd = os.open( + tempfile.mktemp(suffix='.tmp', dir=STATS_DIR), + os.O_WRONLY | os.O_CREAT | os.O_EXCL, + 0o600 + ) + temp_path = f"/proc/self/fd/{fd}" + + with os.fdopen(fd, 'w', encoding='utf-8') as temp_file: json.dump(data, temp_file, ensure_ascii=False, indent=2) temp_path = temp_file.name # 原子重命名 os.replace(temp_path, STATS_FILE) + # 确保最终文件权限正确 + os.chmod(STATS_FILE, 0o600) temp_path = None # 防止在 finally 中再次删除 except (OSError, IOError) as e: logger.error(f"写入统计文件失败: {e}")