[WIP, NOT ready for review] 直接替换maidata.txt谱面的功能 #32
Conversation
…是普通的导入谱面功能发起的。 2. ReplaceChart新增参数shift，仅在导入的是MA2时需要传入，表示延迟调整模式。 3. 并进一步重构 ReplaceChartModal.tsx，确保原来的直接替换MA2功能可用的同时，预留新功能的空间。
Summary of ChangesHello @Starrah, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 此拉取请求旨在扩展现有谱面替换功能，使其能够处理maidata.txt格式的谱面，而不仅仅是MA2格式。通过复用导入时的语法检查逻辑，确保替换的maidata.txt谱面质量。此外，还引入了将导入模式存储到音乐XML元数据中的机制，并对前端UI进行了调整，以更好地支持不同文件类型的替换流程，并为用户提供了关于替换功能适用范围的明确警告。 Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This PR aims to refactor the replaceChart functionality to support maidata.txt charts, enhancing both backend API logic and frontend UI. However, a security audit revealed two significant vulnerabilities in ChartController.cs: a Denial of Service (DoS) risk from reading large files into memory without validation, and a Path Traversal vulnerability allowing arbitrary file overwrites due to unsanitized assetDir parameters. Addressing these security issues is critical. Additionally, there are opportunities to improve the efficiency and robustness of backend file processing.
| public void ReplaceChart(int id, int level, IFormFile file, string assetDir, | ||
| [FromForm] ImportChartController.ShiftMethod? shift) |
There was a problem hiding this comment.
The assetDir parameter, which is a route parameter and thus user-controlled, is used to construct file paths using Path.Combine (e.g., on line 106) without any validation or sanitization. An attacker can provide a path containing directory traversal sequences (e.g., ..) to escape the intended directory and overwrite arbitrary files on the server where the application has write permissions.
Remediation: Validate the assetDir parameter against an allowlist of expected directory names or sanitize it to remove any path traversal sequences before using it in file system operations.
There was a problem hiding this comment.
@clansty 这个用管吗😰 虽然他说有问题的这段并不是我写的，我只是加了个shift参数而已（
| string fileContent; | ||
| using (var reader = new StreamReader(file.OpenReadStream())) | ||
| { | ||
| fileContent = reader.ReadToEnd(); |
There was a problem hiding this comment.
The ReplaceChart method at this line reads the entire content of an uploaded file into memory using reader.ReadToEnd() without any size validation. This creates a Denial of Service (DoS) risk, as a large file could lead to an OutOfMemoryException and application crash, especially when passed to ParseTNumAllFromMa2. Additionally, the current implementation has two code quality issues: it attempts to read the file stream multiple times (file.CopyTo(stream) then file.OpenReadStream()), which can cause errors with non-seekable streams, and it includes a redundant stream.Close() within a using statement. It is recommended to implement a maximum file size limit, process files using a stream-based approach, and refactor to read the file content only once for both writing and parsing.
There was a problem hiding this comment.
这个不用太管吧，后端是在用户自己的电脑上运行的，我DoS我自己吗？
| const checkRet = (await api.ImportChartCheck({file, isReplacement: true})).data; | ||
| if (!checking.value) return; // 说明检查期间用户点击了关闭按钮、取消了操作。则不再执行后续流程。 | ||
| // TODO 显示导入界面（类似ErrorDisplayIdInput）、完成导入流程 | ||
| console.log(checkRet) |
There was a problem hiding this comment.
这里有一个 console.log 语句，可能是用于调试的。在代码最终合并之前，建议移除这些调试相关的日志输出，以保持生产环境代码的整洁。
1 participant
2025年挖过的坑，现在开始填。
draft状态， NOT ready for review