fix: 修复漏洞

Author: SilianZ

core/classes.py

@@ -4,7 +4,10 @@
 from aiohttp import web
 from tqdm import tqdm
 from typing import Union
+from multidict import MultiMapping
+from aiohttp.client_exceptions import ClientResponseError
 import io
+import aiohttp
 
 
 @dataclass
@@ -53,4 +56,4 @@ async def express(self,
 
     @abstractmethod
     async def recycleFiles(self, files: FileList) -> None:
-        pass
+        pass

core/cluster.py

@@ -542,7 +542,7 @@ async def checkStorages(self) -> bool:
             await asyncio.gather(*(storage.check() for storage in self.storages))
         )
 
-    def readLong(self, stream: io.BytesIO):
+    def readLong(self, stream: io.BytesIO) -> int:
         result, shift = 0, 0
         while True:
             byte = ord(stream.read(1))
@@ -552,5 +552,5 @@ def readLong(self, stream: io.BytesIO):
             shift += 7
         return (result >> 1) ^ -(result & 1)
 
-    def readString(self, stream: io.BytesIO):
+    def readString(self, stream: io.BytesIO) -> str:
         return stream.read(self.readLong(stream)).decode()

core/config.py

@@ -34,7 +34,7 @@ def __init__(self, path: str) -> None:
             for key, value in defaults.items():
                 self.set(key, value)
 
-    def load(self):
+    def load(self) -> None:
         with open(self.file, "r", encoding="utf-8") as f:
             self.cfg = yaml.load(f.read(), Loader=yaml.FullLoader) or {}
 
@@ -52,20 +52,20 @@ def set(self, key: str, value: Any):
         self._setValue(self.cfg, key.split("."), value)
         self.save()
 
-    def save(self):
+    def save(self) -> None:
         self.file.parent.mkdir(parents=True, exist_ok=True)
         with open(self.file, "w", encoding="utf-8") as f:
             yaml.dump(data=self.cfg, stream=f, allow_unicode=True)
 
-    def _getValue(self, dict_obj, keys):
+    def _getValue(self, dict_obj, keys) -> dict | None:
         for key in keys:
             if key in dict_obj:
                 dict_obj = dict_obj[key]
             else:
                 return None
         return dict_obj
 
-    def _setValue(self, dict_obj, keys, value):
+    def _setValue(self, dict_obj, keys, value) -> None:
         for _, key in enumerate(keys[:-1]):
             if key not in dict_obj:
                 dict_obj[key] = {}

core/i18n.py

@@ -16,7 +16,7 @@ def __getitem__(self, key: str):
     def __contains__(self, key: str):
         return key in self.data
 
-    def load(self):
+    def load(self) -> None:
         with open(self.path, "r", encoding="utf-8") as f:
             d = f.read()
             self.data = json.loads(d)

core/logger.py

@@ -1,14 +1,15 @@
-from loguru import logger as Logger, Record
+from loguru import logger as Logger
 from pathlib import Path
-import sys
 from core.config import Config
 from core.i18n import locale
+import sys
+
 
 basic_logger_format = "<green>[{time:YYYY-MM-DD HH:mm:ss}]</green><level>[{level}]<yellow>[{name}:{function}:{line}]</yellow>: {message}</level>"
 debug_mode = Config.get("advanced.debug")
 
 
-def filter(record: Record) -> bool:
+def filter(record) -> bool:
     if record["name"] and "apscheduler" in record["name"]:
         record["extra"] = {"depth": 2}
     return True

core/orm.py

@@ -3,6 +3,7 @@
 from datetime import timedelta, datetime
 from calendar import monthrange
 from typing import List, Dict
+from re import Match
 import time
 import re
 
@@ -44,8 +45,8 @@ def writeHits(hits: int, bytes: int) -> None:
 
 
 def writeAgent(agent: str, hits: int) -> None:
-    agent = re.match(r"^(.*?)/", agent).group(1)
-    if agent not in ["bmclapi-ctrl", "bmclapi-warden"]:
+    regex = re.match(r"^(.*?)/", agent) or Match()
+    if regex.group(1) not in ["bmclapi-ctrl", "bmclapi-warden"]:
         agent_info = session.get(AgentInfo, agent)
         if agent_info:
             agent_info.hits += hits

core/router.py

@@ -39,7 +39,7 @@ def init(self) -> None:
         @self.route.get("/download/{hash}")
         async def _(
             request: web.Request,
-        ) -> web.Response:
+        ) -> Union[web.Response, web.FileResponse]:
             self.connection += 1
             writeAgent(request.headers["User-Agent"], 1)
             file_hash = request.match_info.get("hash", "").lower()

installer/installer.sh

@@ -35,7 +35,7 @@ fi
 MIRROR_PREFIX="https://ghproxy.bugungu.top/"
 echo "MIRROR_PREFIX=${MIRROR_PREFIX}"
 
-REPO='TTB-Network/python-openbmclapi'
+REPO='TTB-Network/python-openbmclapi-v2'
 RAW_PREFIX="${MIRROR_PREFIX}https://raw.githubusercontent.com"
 RAW_REPO="$RAW_PREFIX/$REPO"
 BASE_PATH=/opt/python-openbmclapi
@@ -77,7 +77,7 @@ function fetchBlob(){
 	target=$2
 	filemod=$3
 
-	source="$RAW_REPO/master/$file"
+	source="$RAW_REPO/main/$file"
 	echo -e "\e[34m==> Downloading $source\e[0m"
 	tmpf=$(mktemp -t python-openbmclapi.XXXXXXXXXXXX.downloading)
 	curl -fsSL -o "$tmpf" "$source" || { rm "$tmpf"; return 1; }