Repository navigation
Conversation
Influence: - CWE-78: execute autostop scripts directly instead of bash -c to avoid shell injection - CWE-290: use /proc/<PID>/exe symlink instead of cmdline text for caller verification
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideHardens sessionmanager by authenticating SetLocked callers through /proc executable identity rather than spoofable cmdline contents, and by directly executing only executable autostop files without a shell. Sequence diagram for secure SetLocked caller authenticationsequenceDiagram
participant Caller
participant SessionManager
participant ProcFS as /proc/PID/exe
Caller->>SessionManager: SetLocked(lock)
SessionManager->>ProcFS: symLinkTarget(/proc/PID/exe)
ProcFS-->>SessionManager: executable path
alt path is /usr/bin/dde-lock or /usr/libexec/deepin/dde-lock
SessionManager->>SessionManager: apply lock state
else path is not authorized
SessionManager-->>Caller: reject request
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
deepin pr auto review🤖 AI 代码审查报告总体评分： 📊 总体评价
🔍 详细分析1. 语法逻辑 ✅评价： 语法正确，逻辑清晰 ✅ 通过 潜在问题： 建议： [] 2. 代码质量 ✅评价： 代码结构清晰，注释完整 ✅ 通过 潜在问题： 建议： ['可在 QFile::symLinkTarget 返回空字符串时增加专门检查并输出不同级别的日志，例如 qWarning() << "SetLocked: failed to resolve caller exe for pid:" << pid; 以区分解析失败与非法调用者'] 3. 代码性能 ✅评价： 性能良好，资源使用合理 ✅ 通过 潜在问题： 建议： [] 4. 代码安全 🔒评价： 存在0个安全漏洞 ✅ 通过
安全漏洞详情： 建议： ['建议确认 EXEC_COMMAND 宏内部实现是否使用 execvp 直接执行而非通过 shell，以确保彻底消除命令注入风险'] 💡 改进建议代码示例// SetLocked 函数建议增加空路径检查以提升可调试性：
void SessionManager::SetLocked(bool lock)
{
uint pid = connection().interface()->servicePid(message().service()).value();
// 使用 /proc/<PID>/exe 符号链接验证调用者可执行文件路径，避免 cmdline 伪造
QString exePath = QFile::symLinkTarget(QString("/proc/%1/exe").arg(pid));
if (exePath.isEmpty()) {
qWarning() << "SetLocked: failed to resolve caller exe for pid:" << pid;
return;
}
if (exePath != "/usr/bin/dde-lock" && exePath != "/usr/libexec/deepin/dde-lock") {
qWarning() << "SetLocked: illegal caller exe:" << exePath;
return;
}
// ... 后续逻辑
}本报告由 AI 代码审查工具自动生成 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
安全修复
CWE-78: OS命令注入 (sessionmanager.cpp:633)
CWE-290: 认证绕过 (sessionmanager.cpp:492)
Summary by Sourcery
Harden session manager caller validation and autostop script execution against command injection and authentication bypass vulnerabilities.
Bug Fixes: