chore: update changelog to 6.1.91#1121
Merged
Merged
Conversation
update changelog to 6.1.91 Log: update changelog to 6.1.91
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the Debian changelog to reflect a new package version 6.1.91 for the master branch, with no other code or configuration changes. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
TAG Bot TAG: 6.1.91 |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
deepin pr auto review你好！我是CodeGeeX。我已仔细审查了你提供的Git Diff记录。 从Diff内容来看，这是一个Debian changelog的更新，记录了 由于本次Diff仅包含 一、 代码安全本次修复的核心是安全，针对“SetPassword DBus 方法”和“chpasswd 注入”，以下是关键的安全审查点和改进意见：
二、 语法逻辑如果原代码存在注入漏洞，其逻辑通常存在缺陷。以下是修复时应遵循的逻辑规范：
三、 代码质量
四、 代码性能密码修改操作属于极低频操作，性能通常不是核心考量，但以下两点值得注意：
附：安全修复代码示例如果你的项目是使用 Go 语言编写的（ ❌ 不安全的代码（存在 chpasswd 注入）import "os/exec"
func SetPassword(username, password string) error {
// 严重漏洞：如果 username 或 password 包含换行符或特殊字符，会导致注入
// 例如 password = "root:hackpass\nuser:hackpass"
cmd := exec.Command("bash", "-c", fmt.Sprintf("echo '%s:%s' | chpasswd", username, password))
return cmd.Run()
}✅ 安全的代码（使用管道传递，无 Shell 拼接，并校验输入）import (
"bytes"
"fmt"
"os/exec"
"regexp"
)
func SetPassword(username, password string) error {
// 1. 严格校验用户名，防止注入
validUsername := regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
if !validUsername.MatchString(username) {
return fmt.Errorf("invalid username format")
}
// 2. 检查密码中是否包含换行符，防止 chpasswd 行截断
if bytes.ContainsAny([]byte(password), "\n\r") {
return fmt.Errorf("invalid password format: contains newline characters")
}
// 3. 安全调用 chpasswd：不通过 shell 拼接，直接通过 Stdin 管道写入
cmd := exec.Command("chpasswd")
cmd.Stdin = bytes.NewBufferString(fmt.Sprintf("%s:%s", username, password))
output, err := cmd.CombinedOutput()
if err != nil {
return fmt.Errorf("chpasswd failed: %s, error: %v", string(output), err)
}
return nil
}总结：你的 Changelog 提到了一个非常关键的安全修复。建议在实际的代码提交中，确保不仅禁用了 DBus 接口，还彻底清除了底层可能引发 |
xionglinlin
approved these changes
May 22, 2026
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mhduiy, xionglinlin The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
|
TAG Bot ✅ Tag created successfully 📋 Tag Details
|
This was referenced May 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
更新说明
自动更新 changelog 到版本 6.1.91
变更内容
版本信息
Summary by Sourcery
Documentation: