Skip to content

fix: security audit — shell injection, hardcoded IP, .DS_Store, .gitignore #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: security audit — shell injection, hardcoded IP, .DS_Store, .gitignore #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,17 @@ CUDA-Learn/cg_demo
*.fatbin
*.cubin
*.ptx

# OS-generated files
.DS_Store
Thumbs.db

# Secrets and environment files
.env
.env.*
!.env.example

# Editor/IDE files
*.swp
*.swo
*~
Binary file removed Cute-Learn/.DS_Store
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion MySkills/.claude/skills/nsys-profile-fd/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ report_dir = /root/paddlejob/workspace/env_run/output/zhushengguang/jobspace/
report_prefix = dsv32_5layer_cudagraph
param_key = use_cudagraph
param_vals = false,true
wait_ip = 10.95.239.139
wait_ip = <INTERNAL_IP>
wait_port = 8291
nsys_session = zsg
```
Expand Down
11 changes: 10 additions & 1 deletion MySkills/.claude/skills/nsys-profile-fd/scripts/patch_config.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,17 @@ if [ ! -f "$FILE" ]; then
exit 1
fi

# Validate KEY: only allow alphanumeric chars and underscores
if ! echo "$KEY" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
echo "错误: key 只允许字母、数字和下划线: $KEY" >&2
exit 1
fi

# Escape sed special characters in VAL (/, &, \)
ESCAPED_VAL=$(printf '%s' "$VAL" | sed 's/[\/&\\]/\\&/g')

# 替换 JSON 字段值（匹配 "key": 任意值，直到逗号或右花括号前）
sed -i "s/\"${KEY}\":[[:space:]]*[^,}]*/\"${KEY}\":${VAL}/" "$FILE"
sed -i "s/\"${KEY}\":[[:space:]]*[^,}]*/\"${KEY}\":${ESCAPED_VAL}/" "$FILE"

# 验证替换结果
RESULT=$(grep "\"${KEY}\"" "$FILE")
Expand Down