Skip to content

Bug 1 & 5:WriteFileTool 范围校验(WriteFileTool.java 新增校验逻辑)#1084

Open
Fruank4 wants to merge 2 commits intoagentscope-ai:mainfrom
Fruank4:fix/20260331_dangerous_check
Open

Bug 1 & 5:WriteFileTool 范围校验(WriteFileTool.java 新增校验逻辑)#1084
Fruank4 wants to merge 2 commits intoagentscope-ai:mainfrom
Fruank4:fix/20260331_dangerous_check

Conversation

@Fruank4
Copy link
Copy Markdown

@Fruank4 Fruank4 commented Mar 31, 2026

Bug1: parseRanges 本身保持宽松解析(兼容 ReadFileTool 的负数倒序索引),在 WriteFileTool 业务层增加明确校验:start < 1 或 start > end 时直接返回错误信息,防止行内容被重复写入。

Bug 2:预览路径不一致(FileToolUtils.java + WriteFileTool.java) viewTextFile 签名从 String filePath 改为 Path path,调用方传入已验证的绝对路径,消除相对路径基于 CWD 解析导致读取到错误文件的问题。

Bug 3:ListHashUtil 采样 hash 漏检(ListHashUtil.java)
放弃 5 点采样 + String.hashCode() 的弱 hash,改为 SHA-256 全量遍历,任意位置元素变更都能被可靠检测,触发正确的全量重写而非增量追加。

Bug 4:范围替换换行不一致(WriteFileTool.java)
将 String.join("\n", newContent) + Files.writeString 改为 Files.write(path, newContent, charset),与 insertTextFile 保持一致,使用系统换行符,并保留文件末尾换行符。

Bug 6:urlToInputStream 传 null NPE(MediaUtils.java) 在方法入口增加 null/blank 检查,改为抛 IOException 而非无声 NPE,调用方可正常 catch 处理。

parseRanges 本身保持宽松解析(兼容 ReadFileTool 的负数倒序索引),在 WriteFileTool 业务层增加明确校验:start < 1 或 start > end 时直接返回错误信息,防止行内容被重复写入。

Bug 2:预览路径不一致(FileToolUtils.java + WriteFileTool.java)
viewTextFile 签名从 String filePath 改为 Path path,调用方传入已验证的绝对路径,消除相对路径基于 CWD 解析导致读取到错误文件的问题。

Bug 3:ListHashUtil 采样 hash 漏检(ListHashUtil.java)
放弃 5 点采样 + String.hashCode() 的弱 hash,改为 SHA-256 全量遍历,任意位置元素变更都能被可靠检测,触发正确的全量重写而非增量追加。

Bug 4:范围替换换行不一致(WriteFileTool.java)
将 String.join("\n", newContent) + Files.writeString 改为 Files.write(path, newContent, charset),与 insertTextFile 保持一致,使用系统换行符,并保留文件末尾换行符。

Bug 6:urlToInputStream 传 null NPE(MediaUtils.java)
在方法入口增加 null/blank 检查,改为抛 IOException 而非无声 NPE,调用方可正常 catch 处理。
@Fruank4 Fruank4 requested a review from a team March 31, 2026 07:13
@cla-assistant
Copy link
Copy Markdown

cla-assistant bot commented Mar 31, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ Fruank4
❌ lichuang34


lichuang34 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@cla-assistant
Copy link
Copy Markdown

cla-assistant bot commented Mar 31, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


lichuang34 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@Fruank4
Copy link
Copy Markdown
Author

Fruank4 commented Mar 31, 2026

some dangerous check~

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 31, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant