Merge "master" into "feature/yg/meego-7022395131-ve-login-support"

Conflicts:
README.EN.MD

Author: 于果

README.EN.MD

@@ -417,3 +417,7 @@ The following code examples are provided:
     ```shell
     ve rds_mysql ModifyDBInstanceIPList --body '{"InstanceId":"xxxxxx", "GroupName": "xxxxxx", "IPList": ["10.20.30.40", "50.60.70.80"]}'
     ```
+
+## Security and privacy
+This project takes security seriously. 
+For vulnerability reporting and supported versions, see [SECURITY.md](SECURITY.md)

README.MD

@@ -436,7 +436,10 @@ ve <service name> <action> [--parameter1 value1 --parameter2 value2 ...]
     ve rds_mysql ModifyDBInstanceIPList --body '{"InstanceId":"xxxxxx", "GroupName": "xxxxxx", "IPList": ["10.20.30.40", "50.60.70.80"]}'
     ```
 
-    
+
+## Security and privacy
+This project takes security seriously. 
+For vulnerability reporting and supported versions, see [SECURITY.md](SECURITY.md)    
 
 
 

SECURITY.md

@@ -0,0 +1,7 @@
+## Security and privacy
+If you discover potential security issues in the project, or believe you may have found a security issue, please notify the ByteDance security team through our [security center](https://security.bytedance.com/src/) or [vulnerability reporting email](mailto:src@bytedance.com). Please do not create public GitHub Issues.
+We will assess the vulnerability based on the Common Vulnerability Scoring System (CVSS 3.1). The security team will keep you updated on key progress and may request further information or guidance from you. You are welcome to contact us via the email or website mentioned above to ask questions or discuss disclosure matters.
+To protect the security of our customers, ByteDance requests that you do not publish or share information regarding the vulnerability in any public forum, nor publish or share data involving users, until the vulnerability has been remediated and our users have been notified. Please understand that the time required for remediation depends on the severity of the vulnerability and the scope of the impact.
+Individuals, companies, and security teams may wish to publish security advisories on their own websites or other forums. Please contact us via the email or website mentioned above prior to publication to discuss the information that can be disclosed and to coordinate the disclosure timeline.
+## Bug Bounty Reward
+[For the policy of bug bounty reward](https://bytedance.larkoffice.com/docx/ZstQd7bbooDctqxBCAmcFasOngd), if you have any questions about the rules, please contact [https://src.bytedance.com/home](https://src.bytedance.com/home) for consultation.

cmd/cmd_action.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -87,6 +88,7 @@ func doAction(ctx *Context, serviceName, action string) (err error) {
 	method := "GET"
 	contentType := ""
 	apiInfo := rootSupport.GetApiInfo(serviceName, action)
+	apiMeta := rootSupport.GetApiMeta(serviceName, action)
 
 	if apiInfo != nil && apiInfo.Method != "" {
 		method = apiInfo.Method
@@ -100,7 +102,14 @@ func doAction(ctx *Context, serviceName, action string) (err error) {
 	for _, f := range ctx.dynamicFlags.flags {
 		// rebuild input
 		if f.Name != "body" {
-			if a, success := util.ParseToJsonArrayOrObject(strings.TrimSpace(f.value)); success {
+			// Skip JSON parsing for parameters whose declared type is "string".
+			// Without this, a value like '{"Statement":[...]}' is deserialized
+			// into a Go map and then flattened into query params, which breaks
+			// APIs that expect a raw JSON string (e.g. IAM CreatePolicy's
+			// PolicyDocument parameter).
+			if isStringParam(apiMeta, f.Name) {
+				input[f.Name] = f.value
+			} else if a, success := util.ParseToJsonArrayOrObject(strings.TrimSpace(f.value)); success {
 				input[f.Name] = a
 			} else {
 				input[f.Name] = f.value
@@ -173,6 +182,69 @@ func doAction(ctx *Context, serviceName, action string) (err error) {
 	return
 }
 
+// isStringParam reports whether the named parameter should be treated as a
+// literal string when rebuilding request input.
+//
+// This includes both parameters declared as type "string" and indexed
+// elements of repeated string arrays whose metadata key ends with ".N" and is
+// declared as "array[string]" (for example ResourceNames.N -> --ResourceNames.0).
+// In those cases the caller must NOT attempt to parse the value as JSON.
+func isStringParam(apiMeta *ApiMeta, name string) bool {
+	mt, matchedKey, ok := getRequestMetaType(apiMeta, name)
+	if !ok {
+		return false
+	}
+
+	switch mt.TypeName {
+	case "string":
+		return true
+	case "array[string]":
+		return isIndexedStringArrayElement(matchedKey)
+	default:
+		return false
+	}
+}
+
+func isIndexedStringArrayElement(matchedKey string) bool {
+	return strings.HasSuffix(matchedKey, ".N")
+}
+
+func getRequestMetaType(apiMeta *ApiMeta, name string) (*MetaType, string, bool) {
+	if apiMeta == nil || apiMeta.Request == nil || apiMeta.Request.MetaTypes == nil {
+		return nil, "", false
+	}
+
+	if mt, ok := apiMeta.Request.MetaTypes[name]; ok {
+		return mt, name, true
+	}
+
+	normalizedName := normalizeMetaTypeKey(name)
+	if normalizedName == name {
+		return nil, "", false
+	}
+
+	mt, ok := apiMeta.Request.MetaTypes[normalizedName]
+	return mt, normalizedName, ok
+}
+
+func normalizeMetaTypeKey(name string) string {
+	parts := strings.Split(name, ".")
+	changed := false
+
+	for i, part := range parts {
+		if _, err := strconv.Atoi(part); err == nil {
+			parts[i] = "N"
+			changed = true
+		}
+	}
+
+	if !changed {
+		return name
+	}
+
+	return strings.Join(parts, ".")
+}
+
 func actionUsageTemplate(params []string) string {
 	sort.Strings(params)
 

cmd/cmd_action_test.go

@@ -0,0 +1,125 @@
+package cmd
+
+import "testing"
+
+func TestIsStringParam(t *testing.T) {
+	tests := []struct {
+		name     string
+		apiMeta  *ApiMeta
+		param    string
+		expected bool
+	}{
+		{
+			name:     "nil apiMeta",
+			apiMeta:  nil,
+			param:    "PolicyDocument",
+			expected: false,
+		},
+		{
+			name: "string type param",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"PolicyDocument": {TypeName: "string"},
+						"PolicyName":     {TypeName: "string"},
+					},
+				},
+			},
+			param:    "PolicyDocument",
+			expected: true,
+		},
+		{
+			name: "non-string type param",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"Filters": {TypeName: "object"},
+					},
+				},
+			},
+			param:    "Filters",
+			expected: false,
+		},
+		{
+			name: "unknown param",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"PolicyName": {TypeName: "string"},
+					},
+				},
+			},
+			param:    "Unknown",
+			expected: false,
+		},
+		{
+			name: "indexed repeated string param",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"TagFilters.N.Key": {TypeName: "string"},
+					},
+				},
+			},
+			param:    "TagFilters.1.Key",
+			expected: true,
+		},
+		{
+			name: "indexed repeated string array element",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"TagFilters.N.Values.N": {TypeName: "array[string]"},
+					},
+				},
+			},
+			param:    "TagFilters.1.Values.1",
+			expected: true,
+		},
+		{
+			name: "indexed root string array element",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"ResourceNames.N": {TypeName: "array[string]"},
+					},
+				},
+			},
+			param:    "ResourceNames.0",
+			expected: true,
+		},
+		{
+			name: "root string array is not treated as string literal",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"ResourceNames": {TypeName: "array[string]"},
+					},
+				},
+			},
+			param:    "ResourceNames",
+			expected: false,
+		},
+		{
+			name: "indexed repeated non-string param",
+			apiMeta: &ApiMeta{
+				Request: &Meta{
+					MetaTypes: map[string]*MetaType{
+						"TagFilters.N": {TypeName: "object"},
+					},
+				},
+			},
+			param:    "TagFilters.1",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := isStringParam(tt.apiMeta, tt.param)
+			if got != tt.expected {
+				t.Errorf("isStringParam(%v, %q) = %v, want %v", tt.apiMeta, tt.param, got, tt.expected)
+			}
+		})
+	}
+}

cmd/root_support.go

@@ -117,6 +117,13 @@ func (r *RootSupport) GetVersion(svc string) string {
 	return r.Versions[svc]
 }
 
+func (r *RootSupport) GetApiMeta(svc string, action string) *ApiMeta {
+	if metas, ok := r.SupportTypes[svc]; ok {
+		return metas[action]
+	}
+	return nil
+}
+
 func (r *RootSupport) GetApiInfo(svc string, action string) *ApiInfo {
 	for k, v := range r.SupportAction {
 		if k == svc {

cmd/version.go

@@ -12,4 +12,4 @@ var clientVersionAndUserAgentHandler = request.NamedHandler{
 }
 
 const clientName = "volcengine-cli"
-const clientVersion = "1.0.39"
+const clientVersion = "1.0.40"