增量优化 - #238
Open
Yuai123star wants to merge 18 commits into
Hidden character warning
The head ref may contain hidden characters: "\u589e\u91cf\u4f18\u5316"
Open
增量优化#238Yuai123star wants to merge 18 commits into
Yuai123star wants to merge 18 commits into
Conversation
Added new PHP security rules for code auditing, including checks for dangerous functions, SQL injection, and insecure deserialization.
Added PHP authentication examples highlighting insecure practices and secure methods.
Added PHP code snippet for safe deserialization practices.
Added examples of unsafe and safe SQL practices in PHP, including raw queries and prepared statements. Included detection keywords and validation methods for SQL injection.
Added PHP code examples for safe file handling and path validation to prevent path traversal vulnerabilities.
Added PHP examples demonstrating SSRF vulnerabilities and safe URL handling.
Add PHP examples for secure output escaping.
Added PHP examples for disabling external entities in XML parsing.
Add Laravel security knowledge document with common vulnerabilities and best practices.
Add security knowledge for ThinkPHP framework including vulnerabilities and safe coding practices.
Enhance report generation service to support multiple output formats (PDF, Markdown, HTML, JSON) and add statistical overview features.
Updated the export_task_report function to support multiple formats (pdf, markdown, html, json) and kept the legacy '/report/pdf' route as an alias. Adjusted the response handling and added format normalization.
Added support for exporting reports in Markdown and HTML formats. Updated export format options and adjusted UI accordingly.
Added functions to get distinct agent names, export logs as JSON and Markdown, and trigger file downloads.
Added agent name filtering and log export functionality.
|
@Yuai123star is attempting to deploy a commit to the tsinghuaiiilove-2257's projects Team on Vercel. A member of the Team first needs to authorize it. |
PR Summary by QodoExpand PHP auditing, report exports, and agent log tooling
AI Description
Diagram
High-Level Assessment
Files changed (18)
|
Code Review by Qodo
1. Missing report API client
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
| export async function exportToPDF(task: AuditTask, _issues: AuditIssue[]) { | ||
| try { | ||
| const blob = await api.exportTaskReportPDF(task.id); | ||
| const blob = await api.exportTaskReport(task.id, "pdf"); |
There was a problem hiding this comment.
1. Missing report api client 🐞 Bug ≡ Correctness
All three server-backed export functions call api.exportTaskReport, but the API object only defines exportTaskReportPDF. The frontend therefore fails type checking and cannot export PDF, Markdown, or HTML through the new endpoint.
Agent Prompt
## Issue description
Implement the `exportTaskReport` API method used by the new report export functions.
## Issue Context
The method must request `/tasks/{taskId}/report`, pass the selected format as a query parameter, request a Blob response, and remain compatible with the legacy PDF method if it is retained.
## Fix Focus Areas
- frontend/src/shared/api/database.ts[246-253]
- frontend/src/features/reports/services/reportExport.ts[59-89]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+8
to
+11
| LARAVEL_SECURITY = KnowledgeDocument( | ||
| id="framework_laravel", | ||
| title="Laravel Security", | ||
| category=KnowledgeCategory.FRAMEWORK, |
There was a problem hiding this comment.
2. Framework knowledge never registered 🐞 Bug ≡ Correctness
The new Laravel and ThinkPHP documents are not imported or added to ALL_FRAMEWORK_DOCS. Built-in loading and RAG indexing therefore omit both documents entirely.
Agent Prompt
## Issue description
Register the new Laravel and ThinkPHP documents in the framework knowledge registry.
## Issue Context
RAG loads framework knowledge exclusively through `ALL_FRAMEWORK_DOCS`, so merely defining each document does not make it discoverable.
## Fix Focus Areas
- backend/app/services/agent/knowledge/frameworks/__init__.py[7-32]
- backend/app/services/agent/knowledge/frameworks/laravel.py[8-14]
- backend/app/services/agent/knowledge/frameworks/thinkphp.py[8-14]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
1004
to
+1005
| score = task.get('quality_score', 0) | ||
|
|
||
| processed = cls._process_issues(issues) |
There was a problem hiding this comment.
3. Json report corrupts text 🐞 Bug ≡ Correctness
generate_task_report HTML-escapes issue fields before dispatching every format, and _render_json serializes those processed fields directly. JSON consumers receive values such as <script> and ' instead of the stored code, descriptions, and paths.
Agent Prompt
## Issue description
Separate canonical issue normalization from output-specific HTML escaping so JSON contains original values.
## Issue Context
HTML/PDF output needs contextual escaping, while JSON and Markdown must not reuse entity-encoded data.
## Fix Focus Areas
- backend/app/services/report_generator.py[744-780]
- backend/app/services/report_generator.py[921-949]
- backend/app/services/report_generator.py[1000-1021]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+914
to
+917
| def _render_html(cls, context: Dict[str, Any]) -> bytes: | ||
| """渲染独立 HTML 报告（纯模板，无 WeasyPrint 依赖）""" | ||
| template = Template(cls._HTML_TEMPLATE) | ||
| html_content = template.render(**context) |
There was a problem hiding this comment.
4. Report html permits injection 🐞 Bug ⛨ Security
The new HTML renderer uses a Jinja Template without autoescaping while interpolating the raw project and branch names into the document. A crafted project or branch name is emitted as executable markup in the downloaded HTML report rather than report text.
Agent Prompt
## Issue description
Render standalone HTML through an autoescaping Jinja environment and stop relying on partial manual escaping.
## Issue Context
Project names and scan branch names are accepted without HTML validation and are included in the report subtitle.
## Fix Focus Areas
- backend/app/services/report_generator.py[914-918]
- backend/app/services/report_generator.py[1007-1010]
- backend/app/api/v1/endpoints/projects.py[31-47]
- backend/app/api/v1/endpoints/projects.py[489-523]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+264
to
+265
| (r'(!==)\s*0', "神奇哈希 '0e...' 判定"), | ||
| (r'in_array\s*\([^)]*\)\s*(?!.*,\s*true)', "in_array未开启严格模式"), |
There was a problem hiding this comment.
5. Strict php checks misclassified 🐞 Bug ≡ Correctness
The new type-juggling rules classify !== 0 as a vulnerability and evaluate the in_array negative lookahead only after the closing parenthesis. Consequently safe strict comparisons and in_array($value, $list, true) are reported as insecure.
Agent Prompt
## Issue description
Replace the type-juggling expressions with patterns that distinguish weak checks from safe strict checks.
## Issue Context
The `in_array` strictness check must inspect arguments inside the call, and `!== 0` must not be treated as weak comparison.
## Fix Focus Areas
- backend/app/services/agent/tools/pattern_tool.py[257-270]
- backend/app/services/agent/tools/smart_scan_tool.py[145-149]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+141
to
+143
| "deserialization": [ | ||
| (r'unserialize\s*\(\s*\$', "unserialize用户输入"), | ||
| (r'unserialize\s*\(\s*\$_', "反序列化超全局变量"), |
There was a problem hiding this comment.
6. Superglobal unserialize double-counted 🐞 Bug ≡ Correctness
The added unserialize(...$_...) expression is a strict subset of the existing unserialize(...$...) expression. Every direct superglobal call now produces two findings in each scanner, inflating issue counts and duplicated evidence.
Agent Prompt
## Issue description
Make the unserialize expressions mutually exclusive or retain only the more useful expression.
## Issue Context
Both tools iterate all matching regexes and append one finding per match, so overlapping patterns are not deduplicated automatically.
## Fix Focus Areas
- backend/app/services/agent/tools/smart_scan_tool.py[141-143]
- backend/app/services/agent/tools/pattern_tool.py[248-251]
- backend/app/services/agent/tools/smart_scan_tool.py[319-339]
- backend/app/services/agent/tools/pattern_tool.py[435-454]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| (r'proc_open\s*\(\s*\$', "proc_open变量"), | ||
| (r'popen\s*\(\s*\$', "popen变量"), | ||
| (r'`[^`]*\$[^`]*`', "反引号命令执行"), | ||
| (r'preg_replace\s*\(\s*["\'][^"\']*e["\']', "preg_replace /e修饰符"), |
There was a problem hiding this comment.
7. Preg_replace rule overmatches 🐞 Bug ≡ Correctness
The new /e detector merely requires the quoted pattern text to end in the letter e; it does not
require an /e modifier. Benign calls such as preg_replace('safe', ...) are therefore emitted as
critical command-injection findings.
Agent Prompt
## Issue description
Constrain the preg_replace regex to an actual closing delimiter followed by the `e` modifier.
## Issue Context
Account for optional additional modifiers without treating an arbitrary final letter `e` as the modifier.
## Fix Focus Areas
- backend/app/services/agent/tools/pattern_tool.py[153-172]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+136
to
+138
| // 安全 - DOMDocument 禁用网络与外部实体 | ||
| $doc = new DOMDocument(); | ||
| $doc->loadXML($xml, LIBXML_NONET | LIBXML_NOENT | LIBXML_DTDLOAD); |
There was a problem hiding this comment.
8. Xxe guidance enables entities 🐞 Bug ⛨ Security
The PHP example labeled as disabling external entities passes LIBXML_NOENT | LIBXML_DTDLOAD, explicitly requesting entity substitution and DTD loading. RAG can consequently recommend a configuration that enables the behavior the XXE remediation is supposed to prevent.
Agent Prompt
## Issue description
Correct the PHP XXE remediation so it neither loads DTDs nor substitutes external entities.
## Issue Context
Keep network access disabled and provide version-appropriate safe parser examples without contradictory enabling flags.
## Fix Focus Areas
- backend/app/services/agent/knowledge/vulnerabilities/xxe.py[129-141]
- backend/app/services/agent/knowledge/rag_knowledge.py[76-81]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+133
to
+136
| $base = realpath(__DIR__ . '/uploads'); | ||
| $full = realpath($base . '/' . $user_file); | ||
| if ($full === false || strpos($full, $base) !== 0) { | ||
| http_response_code(403); |
There was a problem hiding this comment.
9. Path guard accepts siblings 🐞 Bug ⛨ Security
The purportedly safe PHP path check compares only a raw string prefix, so a resolved sibling such as /srv/uploads-secret/file passes when the base is /srv/uploads. This teaches an LFI/path-traversal guard that still permits files outside the intended directory.
Agent Prompt
## Issue description
Correct the PHP path example to compare against a normalized base path followed by a directory separator.
## Issue Context
Handle failed `realpath` calls and ensure similarly prefixed sibling directories cannot pass containment validation.
## Fix Focus Areas
- backend/app/services/agent/knowledge/vulnerabilities/path_traversal.py[129-145]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+260
to
+263
| if (log.content) { | ||
| lines.push(`\`\`\`text`); | ||
| lines.push(log.content); | ||
| lines.push(`\`\`\``); |
There was a problem hiding this comment.
10. Log markdown fences break 🐞 Bug ≡ Correctness
The log exporter places raw log content inside a fixed triple-backtick fence. Tool or model output containing its own triple backticks closes the block early, producing a malformed and misleading Markdown replay.
Agent Prompt
## Issue description
Serialize log content with a fence longer than any backtick run in the content, or indent the block safely.
## Issue Context
Agent and tool output commonly contains Markdown code blocks and must remain verbatim in replay exports.
## Fix Focus Areas
- frontend/src/pages/AgentAudit/utils.ts[230-268]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
在既有 Multi-Agent 审计链路（orchestrator → recon → analysis → verification）上做定点增量，不改动核心编排，改动聚焦 18 个文件。欢迎 review，也可以在此基础上继续 rebase。
1.PHP 专属规则集 ：
pattern_tool / smart_scan_tool 增加 27 处 PHP 安全模式（危险函数、LFI/命令注入/反序列化等）
让 PHP 从"LLM 泛化看"升级为"规则快速命中 + 为 LLM 提供精确证据上下文"
init_templates.py 注入 php 规则模板
多类漏洞文档补充 PHP 章节
新增 Laravel / ThinkPHP 框架专项知识
接入 RAG（knowledge/rag/indexer.py）
3.报告多格式导出 报告支持 PDF / Markdown / HTML / JSON 四种格式 + 统计概览（各漏洞等级分布、检测器命中、时间线等）。
4.Agent 执行日志
日志可重放（还原执行过程）
按 Agent 维度过滤
导出 JSON / Markdown