-
Notifications
You must be signed in to change notification settings - Fork 124
feat:支持上传反馈、支持钉钉多维表格 #2283
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
feat:支持上传反馈、支持钉钉多维表格 #2283
Changes from all commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
4718362
feat(wework): support DingTalk AI Table projects
Micro66 c17e8c2
feat(wework): add adaptive AI Table task details
Micro66 7c82ce7
feat(feedback): submit diagnostics to project board
Micro66 78737a0
fix(runtime): preserve cloud project context
Micro66 8c126fb
feat: 修复问题
Micro66 a242d88
Merge remote-tracking branch 'origin/human/caracal-20260728-032140' i…
Micro66 9974864
feat: 修复mcp无法使用的问题
Micro66 936c666
feat: fix test
Micro66 a0cdcd4
feat: fix test
Micro66 bb78ed8
Merge remote-tracking branch 'github/main' into human/gecko-20260728-…
Micro66 56af339
feat: 合并代码
Micro66 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| # SPDX-FileCopyrightText: 2026 Weibo, Inc. | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| """Authenticated Wework feedback endpoint.""" | ||
|
|
||
| import json | ||
|
|
||
| from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status | ||
| from pydantic import ValidationError | ||
| from sqlalchemy.orm import Session | ||
|
|
||
| from app.api.dependencies import get_db | ||
| from app.core.security import get_current_user | ||
| from app.models.user import User | ||
| from app.schemas.feedback import FeedbackCreate, FeedbackResponse | ||
| from app.services.feedback_service import feedback_service | ||
|
|
||
| router = APIRouter() | ||
|
|
||
|
|
||
| @router.post("", response_model=FeedbackResponse, status_code=status.HTTP_201_CREATED) | ||
| def submit_feedback( | ||
| report_id: str = Form(...), | ||
| title: str = Form(...), | ||
| description: str = Form(""), | ||
| context: str = Form("{}"), | ||
| bundle: UploadFile = File(...), | ||
| db: Session = Depends(get_db), | ||
| current_user: User = Depends(get_current_user), | ||
| ) -> FeedbackResponse: | ||
| try: | ||
| parsed_context = json.loads(context) | ||
| values = FeedbackCreate( | ||
| report_id=report_id, | ||
| title=title, | ||
| description=description, | ||
| context=parsed_context, | ||
| ) | ||
| except (json.JSONDecodeError, ValidationError) as error: | ||
| raise HTTPException(status.HTTP_422_UNPROCESSABLE_ENTITY, str(error)) from error | ||
| if not isinstance(parsed_context, dict): | ||
| raise HTTPException( | ||
| status.HTTP_422_UNPROCESSABLE_ENTITY, "context must be an object" | ||
| ) | ||
| return feedback_service.submit(db, current_user, values, bundle) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Serving attachment bytes
inlinewith a provider-suppliedmedia_typeand unescaped filename is risky.Two concerns on this new endpoint:
content_typeoriginates from the uploaded file (file.content_typeat Line 359 for local attachments). Servingtext/htmlorimage/svg+xmlinlinefrom the API origin allows stored XSS against any session-authenticated browser context.filenameis unsanitized user input; a"or CR/LF in the display name corrupts or injects response headers.Prefer
Content-Disposition: attachmentwith RFC 5987 encoding, plusX-Content-Type-Options: nosniff.🔒 Proposed fix
+from urllib.parse import quote as _url_quotecontent, content_type, filename = loop_item_attachment_provider_router.content( db, attachment_id, current_user.id ) + safe_name = _url_quote(filename or "attachment") return Response( content=content, media_type=content_type, - headers={"Content-Disposition": f'inline; filename="{filename}"'}, + headers={ + "Content-Disposition": f"attachment; filename*=UTF-8''{safe_name}", + "X-Content-Type-Options": "nosniff", + }, )📝 Committable suggestion
🧰 Tools
🪛 Ruff (0.15.21)
[warning] 387-387: Do not perform function call
Dependsin argument defaults; instead, perform the call within the function, or read the default from a module-level singleton variable(B008)
[warning] 388-388: Do not perform function call
Dependsin argument defaults; instead, perform the call within the function, or read the default from a module-level singleton variable(B008)
🤖 Prompt for AI Agents