fix: 修复 org-router shell 注入、cache 权限、actions 版本升级#119
Merged
Conversation
added 3 commits
July 6, 2026 15:32
Move user-supplied content (comment-body, discussion-title, category-name, comment-author, event-type) from CLI arguments to environment variable fallback in parse_args. This prevents shell injection via backticks or in user content, since these values are no longer expanded by bash when constructing the CLI command. Workflow changes in subsequent commit will remove the corresponding CLI args.
…pgrade actions
1. Remove all user-supplied content CLI args (--comment-body, --discussion-title,
--category-name, --event-type, --comment-author) from the 4 router.py
invocations — these are now read from environment variables instead,
eliminating shell injection risk.
2. Add 'actions: write' permission to allow cache save operations to succeed.
3. Upgrade actions/setup-python@v5 → v6, actions/cache/{restore,save}@v4 → v5
to resolve Node.js 20 deprecation warnings.
The 3 tests in TestMainHumanIntervention check for INFO-level log messages via caplog, but caplog's default handler level is WARNING. Add caplog.set_level(logging.INFO) so these messages are captured.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题来源
修复 Actions run #28774182942 中的运行失败。
变更摘要
🔴 Shell 注入修复（核心）
scripts/router.py：--comment-body、--discussion-title、--category-name、--comment-author、--event-type的argparse默认值改为从环境变量（ROUTER_COMMENT_BODY等）读取.github/workflows/org-router.yml：移除 4 处 CLI 调用中的用户内容参数，依赖环境变量传递classify-only和__main__入口的try/except保底：异常时输出OTHER而非崩溃🟡 Cache 写入权限
actions: write到 job permissions，修复 cache save 步骤因 token scope 不足而失败🟡 Actions 版本升级
actions/setup-python@v5→v6actions/cache/restore@v4→v5actions/cache/save@v4→v5🟢 测试修复
tests/test_router.py：3 个TestMainHumanIntervention测试添加caplog.set_level(logging.INFO)，修复预存的日志级别不匹配导致的假失败涉及文件
scripts/router.py.github/workflows/org-router.ymltests/test_router.py验证