Conversation
|
@codecov-ai-reviewer review |
|
Important Review skippedToo many files! This PR contains 1045 files, which is 895 over the limit of 150. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (75)
📒 Files selected for processing (1045)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
|
There was a problem hiding this comment.
Pull request overview
This PR introduces Hubble 2.0, a major architectural update that removes database-backed graph connections in favor of direct authentication tokens, adds multi-tenant graphspace support, and introduces new user management and algorithm service features.
Key Changes
- Replaces database-stored connection management with token-based authentication using
HugeClientPoolService - Adds graphspace-level organization and multi-tenancy capabilities
- Introduces new algorithm service endpoints for OLTP/OLAP graph analytics
- Implements user service with role-based access control and space administration
Reviewed changes
Copilot reviewed 205 out of 957 changed files in this pull request and generated 15 comments.
Show a summary per file
| File | Description |
|---|---|
| GraphsService.java | New service for multi-graph management within graphspaces including statistics and built-in data loading |
| GraphService.java | Updated to use HugeClient directly instead of connection IDs with new element operations |
| WhiteIpListService.java | New service for IP whitelist management |
| UserService.java | New comprehensive user management service with authentication and authorization |
| OltpAlgoService.java | Major expansion adding 20+ graph traversal algorithm implementations |
| HugeClientPoolService.java | Complete rewrite to support token-based client creation with URL discovery |
| GraphConnectionService.java | Removed - functionality replaced by client pool service |
| HubbleOptions.java | Added configuration options for PD cluster, dashboard, and monitoring services |
| CustomInterceptor.java | Updated to inject HugeClient into requests based on graphspace/graph context |
| ExecuteHistory.java | Updated schema from conn_id to graphspace/graph identifiers |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| boolean isClearSchema, boolean isClearData) { | ||
| // TODO client do not support clear Schema field. Check here | ||
| if (isClearSchema) { | ||
| client.graphs().clearGraph(graph,"I'm sure to delete all data"); |
There was a problem hiding this comment.
Missing space after comma in method call argument
Suggested change
| client.graphs().clearGraph(graph,"I'm sure to delete all data"); | |
| client.graphs().clearGraph(graph, "I'm sure to delete all data"); |
|
|
||
| public void delete(HugeClient client, String graph, String confirmMessage) { | ||
| // TODO check if frontend support passing confirm message. | ||
| client.graphs().dropGraph(graph,confirmMessage); |
There was a problem hiding this comment.
Missing space after comma in method call argument
Suggested change
| client.graphs().dropGraph(graph,confirmMessage); | |
| client.graphs().dropGraph(graph, confirmMessage); |
| client); | ||
| HashMap<String, Object> vertexPropertiesMap= new HashMap<>(); | ||
| vertexPropertiesMap.put("nonNullableProps", vlEntity.getNonNullableProps()); | ||
| vertexPropertiesMap.put("NullableProps", vlEntity.getNullableProps()); |
There was a problem hiding this comment.
Inconsistent naming - key uses PascalCase "NullableProps" while other keys use camelCase. Should be "nullableProps" for consistency
| client); | ||
| HashMap<String, Object> edgePropertiesMap= new HashMap<>(); | ||
| edgePropertiesMap.put("nonNullableProps", elEntity.getNonNullableProps()); | ||
| edgePropertiesMap.put("NullableProps", elEntity.getNullableProps()); |
There was a problem hiding this comment.
Inconsistent naming - key uses PascalCase "NullableProps" while other keys use camelCase. Should be "nullableProps" for consistency
Comment on lines
+247
to
+249
| "common.param.must-be-null", "source_id"); | ||
| Ex.check(entity.getTargetId() != null, | ||
| "common.param.must-be-null", "target_id"); |
There was a problem hiding this comment.
Error message key "common.param.must-be-null" is incorrect - should be "cannot-be-null" since the condition checks for null values
Suggested change
| "common.param.must-be-null", "source_id"); | |
| Ex.check(entity.getTargetId() != null, | |
| "common.param.must-be-null", "target_id"); | |
| "common.param.cannot-be-null", "source_id"); | |
| Ex.check(entity.getTargetId() != null, | |
| "common.param.cannot-be-null", "target_id"); |
| .map(GremlinUtil::escapeId) | ||
| .collect(Collectors.toList()); | ||
| String ids = StringUtils.join(escapedIds, ","); | ||
| if (ids == ""){ |
There was a problem hiding this comment.
String comparison using == operator instead of isEmpty() or equals(). Should use ids.isEmpty() or ids.equals("")
Suggested change
| if (ids == ""){ | |
| if (StringUtils.isEmpty(ids)){ |
| .map(GremlinUtil::escapeId) | ||
| .collect(Collectors.toList()); | ||
| String ids = StringUtils.join(escapedIds, ","); | ||
| if (ids == ""){ |
There was a problem hiding this comment.
String comparison using == operator instead of isEmpty() or equals(). Should use ids.isEmpty() or ids.equals("")
Suggested change
| if (ids == ""){ | |
| if (ids.isEmpty()){ |
| "FROM `load_task` as l LEFT JOIN `file_mapping` as f " + | ||
| "ON l.file_id=f.id WHERE l.job_id = #{job_id}") | ||
| JobManagerItem computeSizeDuration(@Param("job_id") int jobId); | ||
| JobManagerItem computeSizeDuration(@Param("job_id") int job_id); |
There was a problem hiding this comment.
Parameter name uses snake_case 'job_id' instead of camelCase 'jobId' which is Java convention
Suggested change
| JobManagerItem computeSizeDuration(@Param("job_id") int job_id); | |
| JobManagerItem computeSizeDuration(@Param("job_id") int jobId); |
| HttpServletResponse response, | ||
| Object handler) { | ||
| String uri = request.getRequestURI(); | ||
| if ("check".equals(uri) || "/api/v1.3/bill/cron".equals(uri)) { // TODO C rmv required? |
There was a problem hiding this comment.
TODO comment indicates uncertainty about requirement - should be clarified or resolved
Suggested change
| if ("check".equals(uri) || "/api/v1.3/bill/cron".equals(uri)) { // TODO C rmv required? | |
| // Allow unauthenticated access to "check" and "/api/v1.3/bill/cron" endpoints (e.g., for health checks or scheduled jobs) | |
| if ("check".equals(uri) || "/api/v1.3/bill/cron".equals(uri)) { |
| @MergeProperty | ||
| @JsonProperty("conn_id") | ||
| private Integer connId; | ||
| @JsonProperty("graphe") |
There was a problem hiding this comment.
Property name misspelled as "graphe" instead of "graph"
Suggested change
| @JsonProperty("graphe") | |
| @JsonProperty("graph") |
Summary of ChangesHello @imbajin, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new major version of Hubble, version 2.0, marking a significant evolution in its architecture and feature set. The changes move away from direct graph connection management towards a more robust and scalable model centered around 'graphspaces' and 'graphs'. This upgrade brings a wealth of new functionalities, including advanced graph algorithms, comprehensive authentication and authorization, improved monitoring and logging, and cutting-edge AI integration for natural language querying. The underlying build system and dependencies have also been thoroughly modernized to support these new capabilities. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a significant refactoring for Hubble 2.0, including a more RESTful API structure, improved client management, and new features like LangChain integration. The changes are extensive and move in a good direction. However, the pull request contains several issues that indicate it might be a work-in-progress, such as commented-out critical code (like authentication checks), numerous TODO comments, debug statements, and potential bugs (like a copy-paste error in an enum). These issues, especially the critical ones, should be addressed before this PR is merged to ensure the stability and correctness of the application.
| private final String name; | ||
|
|
||
| static { | ||
| SerialEnum.register(AppName.class); |
There was a problem hiding this comment.
There seems to be a copy-paste error here. The enum AppType is trying to register AppName.class with SerialEnum. This should be AppType.class instead. This could lead to incorrect serialization behavior.
Suggested change
| SerialEnum.register(AppName.class); | |
| SerialEnum.register(AppType.class); |
Comment on lines
+37
to
+39
| // if (request.getSession().getAttribute(Constant.TOKEN_KEY) == null) { // TODO C why anno.? | ||
| // throw new UnauthorizedException(); | ||
| // } |
There was a problem hiding this comment.
The authentication check in this interceptor is commented out. This effectively disables authentication for the intercepted API endpoints, which is a major security risk. If authentication is intended, this check must be enabled.
Comment on lines
57
to
58
| } catch (Exception ignored) { | ||
| LOG.error("hugeConfig exception"); | ||
| } |
There was a problem hiding this comment.
This empty catch block swallows exceptions silently. This is a dangerous practice as it can hide underlying problems. At a minimum, the exception should be logged. The original logging statement was removed in this change.
Comment on lines
+61
to
+63
| HttpResponse response = new BasicHttpResponse(HttpVersion.HTTP_1_1, | ||
| Constant.STATUS_OK, | ||
| "{\"status\": 401}"); |
There was a problem hiding this comment.
When the user is not authenticated (username == null), the servlet returns an HTTP 200 OK response with a JSON body {"status": 401}. The more standard and correct approach is to return an HTTP 401 Unauthorized status code directly. This makes the API behavior more predictable for clients.
Suggested change
| HttpResponse response = new BasicHttpResponse(HttpVersion.HTTP_1_1, | |
| Constant.STATUS_OK, | |
| "{\"status\": 401}"); | |
| HttpResponse response = new BasicHttpResponse(HttpVersion.HTTP_1_1, | |
| 401, | |
| "Unauthorized"); |
| public static void main(String[] args) { | ||
| System.out.println("user.dir ==> " + System.getProperty("user.dir")); | ||
| initEnv(); | ||
| TimeZone.setDefault(TimeZone.getTimeZone(ZoneOffset.of("+8"))); |
There was a problem hiding this comment.
Setting the default timezone for the entire JVM with TimeZone.setDefault() is generally discouraged as it can have unintended side effects on other parts of the application and its dependencies that rely on the system's default timezone. It's better to handle timezones explicitly where needed, for example, when formatting dates.
Comment on lines
+25
to
+27
| // TODO fix import | ||
| //import org.apache.hugegraph.client.api.traverser.NeighborRankAPI; | ||
| //import org.apache.hugegraph.client.api.traverser.PersonalRankAPI; |
There was a problem hiding this comment.
There is a TODO fix import comment here, along with commented-out imports. This indicates incomplete work that should be resolved before merging.
Comment on lines
+1
to
+82
| ///* | ||
| // * | ||
| // * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| // * contributor license agreements. See the NOTICE file distributed with this | ||
| // * work for additional information regarding copyright ownership. The ASF | ||
| // * licenses this file to You under the Apache License, Version 2.0 (the | ||
| // * "License"); you may not use this file except in compliance with the License. | ||
| // * You may obtain a copy of the License at | ||
| // * | ||
| // * http://www.apache.org/licenses/LICENSE-2.0 | ||
| // * | ||
| // * Unless required by applicable law or agreed to in writing, software | ||
| // * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| // * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| // * License for the specific language governing permissions and limitations | ||
| // * under the License. | ||
| // */ | ||
| // | ||
| //package org.apache.hugegraph.controller.auth; | ||
| // | ||
| //import java.util.List; | ||
| // | ||
| //import org.apache.hugegraph.driver.HugeClient; | ||
| //import org.apache.hugegraph.service.auth.AccessService; | ||
| //import org.springframework.beans.factory.annotation.Autowired; | ||
| //import org.springframework.web.bind.annotation.DeleteMapping; | ||
| //import org.springframework.web.bind.annotation.GetMapping; | ||
| //import org.springframework.web.bind.annotation.PathVariable; | ||
| //import org.springframework.web.bind.annotation.PostMapping; | ||
| //import org.springframework.web.bind.annotation.PutMapping; | ||
| //import org.springframework.web.bind.annotation.RequestBody; | ||
| //import org.springframework.web.bind.annotation.RequestMapping; | ||
| //import org.springframework.web.bind.annotation.RequestParam; | ||
| //import org.springframework.web.bind.annotation.RestController; | ||
| // | ||
| //import org.apache.hugegraph.common.Constant; | ||
| //import org.apache.hugegraph.entity.auth.AccessEntity; | ||
| // | ||
| //@RestController | ||
| //@RequestMapping(Constant.API_VERSION + "graphspaces/{graphspace}/auth/accesses") | ||
| //public class AccessController extends AuthController { | ||
| // | ||
| // @Autowired | ||
| // AccessService accessService; | ||
| // | ||
| // @GetMapping | ||
| // public List<AccessEntity> list(@PathVariable("graphspace") String graphSpace, | ||
| // @RequestParam(value="role_id", required = false) String rid, | ||
| // @RequestParam(value="target_id", required = false) String tid) { | ||
| // HugeClient client = this.authClient(graphSpace, null); | ||
| // return this.accessService.list(client, rid, tid); | ||
| // } | ||
| // | ||
| // @GetMapping("{id}") | ||
| // public AccessEntity get(@PathVariable("graphspace") String graphSpace, | ||
| // @PathVariable("id") String aid) { | ||
| // HugeClient client = this.authClient(graphSpace, null); | ||
| // return this.accessService.get(client, aid); | ||
| // } | ||
| // | ||
| // @PostMapping | ||
| // public AccessEntity add(@PathVariable("graphspace") String graphSpace, | ||
| // @RequestBody AccessEntity accessEntity) { | ||
| // HugeClient client = this.authClient(graphSpace, null); | ||
| // return this.accessService.addOrUpdate(client, accessEntity); | ||
| // } | ||
| // | ||
| // @PutMapping | ||
| // public AccessEntity update(@PathVariable("graphspace") String graphSpace, | ||
| // @RequestBody AccessEntity accessEntity) { | ||
| // HugeClient client = this.authClient(graphSpace, null); | ||
| // return this.accessService.addOrUpdate(client, accessEntity); | ||
| // } | ||
| // | ||
| // @DeleteMapping | ||
| // public void delete(@PathVariable("graphspace") String graphSpace, | ||
| // @RequestParam("role_id") String roleId, | ||
| // @RequestParam("target_id") String targetId) { | ||
| // HugeClient client = this.authClient(graphSpace, null); | ||
| // this.accessService.delete(client, roleId, targetId); | ||
| // } | ||
| //} |
There was a problem hiding this comment.
This entire file is commented out. If this feature is not ready, it should not be included in the pull request. Commented-out code reduces readability and should be removed from the codebase.
| user.setSuperadmin(false); | ||
| userService.update(this.authClient(null, null), user); | ||
| } catch (Exception e) { | ||
| e.printStackTrace(); |
There was a problem hiding this comment.
Using e.printStackTrace() is discouraged in production code. It's better to use a structured logger (like SLF4J) to log the exception with appropriate context. This provides better control over log levels and output formats.
Suggested change
| e.printStackTrace(); | |
| logger.error("Failed to delete super admin role for user {}", id, e); |
| <version>1.33</version> | ||
| </dependency> | ||
| <dependency> | ||
| <!-- TODO X FIX HERE--> |
There was a problem hiding this comment.
This TODO comment indicates that there's an issue to be fixed with this dependency. Such comments should be resolved, or converted into proper issues in a tracking system, before merging the pull request to ensure code quality and maintainability. There are several other TODO comments in this file that should also be addressed.
Comment on lines
+262
to
+285
| //// TODO REMOVED | ||
| //public static final ConfigOption<String> AFS_URI = | ||
| // new ConfigOption<>( | ||
| // "afs.uri", | ||
| // "the uri of afs stored for the olap algorithm's result", | ||
| // null, | ||
| // "afs://cnn-bd-main.afs.baidu.com:9902" | ||
| // ); | ||
| // | ||
| //public static final ConfigOption<String> AFS_USER = | ||
| // new ConfigOption<>( | ||
| // "afs.user", | ||
| // "the user name for accessing afs stored", | ||
| // null, | ||
| // "user" | ||
| // ); | ||
| // | ||
| //public static final ConfigOption<String> AFS_PASSWORD = | ||
| // new ConfigOption<>( | ||
| // "afs.password", | ||
| // "the user password for accessing afs stored", | ||
| // null, | ||
| // "password" | ||
| // ); |
There was a problem hiding this comment.
These AFS-related options are commented out with a TODO REMOVED comment. This should be cleaned up by either removing the commented-out code block entirely or clarifying the status of this feature.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| private void judgeFileExist(String filePath) { | ||
| File file = new File(filePath); | ||
| if (!file.exists()) { |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression
| model, ernieClientId, ernieClientSecret); | ||
|
|
||
| // 构造ProcessBuilder对象 | ||
| ProcessBuilder pb = new ProcessBuilder(args1); |
Check failure
Code scanning / CodeQL
Uncontrolled command line
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
The best way to fix this problem is to ensure that the pythonPath value (the Python interpreter executable) is not arbitrarily provided by the user but instead restricted to a trusted set of installed interpreters. This can be achieved in several ways:
- Preferably, maintain a hardcoded list of allowed interpreter paths, or only allow
pythonPathto take on values like"python3","python", or other known safe paths. - Alternatively, validate the provided
pythonPathagainst a list of allowed values (either via direct comparison or regex matching for allowed paths, and reject anything containing unsafe characters). - If absolute paths must be supported (for multi-interpreter deployments), sanitize the input to allow only well-formed paths, ensuring no shell metacharacters can be injected.
Changes needed:
- Implement a private method to validate
pythonPath(e.g.,validatePythonInterpreterPath). This method should reject any path containing potentially dangerous characters (such as;,&,|, backticks, or whitespace), or only allow paths within a known set. - Call this validation method before constructing the command line in
langchainNoSchemaor withinexcutePythonByProcessBuilder. - Throw an exception if the validation fails, preventing any uncontrolled execution.
No external dependencies are required; standard Java utilities (such as regex or simple string checks) suffice.
Suggested changeset
1
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/langchain/LangChainController.java
| @@ -207,6 +207,9 @@ | ||
| throw new RuntimeException("fileName must not be null"); | ||
| } | ||
|
|
||
| // Validate pythonPath before execution | ||
| validatePythonInterpreterPath(requestLangChainParams.pythonPath); | ||
|
|
||
| List<String> result = | ||
| this.excutePythonByProcessBuilder( | ||
| requestLangChainParams.pythonPath, filePath, | ||
| @@ -548,6 +551,31 @@ | ||
| return argsList.toArray(new String[argsList.size()]); | ||
| } | ||
|
|
||
| /** | ||
| * Validate python interpreter path to prevent command injection. | ||
| * Only allows trusted absolute paths or interpreter names. | ||
| * Throws RuntimeException if validation fails. | ||
| */ | ||
| private void validatePythonInterpreterPath(String pythonPath) { | ||
| if (pythonPath == null || pythonPath.isEmpty()) { | ||
| throw new RuntimeException("pythonPath must not be empty"); | ||
| } | ||
| // Only accept known interpreter names or absolute paths without dangerous characters | ||
| // E.g., allow only "python3", "python", "/usr/bin/python3", or "/usr/local/bin/python3" | ||
| // Disallow any path containing whitespace, semicolon, ampersand, pipe, or backtick | ||
| String allowedBinaryNames = "python python3"; | ||
| // Check for simple binary name | ||
| if (allowedBinaryNames.contains(pythonPath.trim())) { | ||
| return; | ||
| } | ||
| // Check for well-formed absolute path, only allow word characters, slashes, dots | ||
| // Disallow dangerous shell metacharacters | ||
| if (!pythonPath.matches("^/?([\\w.-]+/)*[\\w.-]+$")) { | ||
| throw new RuntimeException("Invalid pythonPath: " + pythonPath); | ||
| } | ||
| // Optionally, you may check if the executable exists: new File(pythonPath).exists() | ||
| } | ||
|
|
||
| private void checkParamsValid(GremlinQuery query) { | ||
| Ex.check(!StringUtils.isEmpty(query.getContent()), | ||
| "common.param.cannot-be-null-or-empty", |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
| // 执行Python文件，并传入参数 | ||
| List<String> lineList = new ArrayList<>(); | ||
| try { | ||
| Process proc = Runtime.getRuntime().exec(args1); |
Check failure
Code scanning / CodeQL
Uncontrolled command line
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
The best way to fix this vulnerability is to only allow a fixed, hard-coded list of safe executables (Python interpreters) to be launched, instead of allowing the client to provide an arbitrary pythonPath. For instance, the server could maintain a whitelist such as just "python3", or /usr/bin/python3, and completely ignore/disallow the pythonPath input from the user, or only accept a whitelisted value/alias (for example, "python3" or "python3.10", mapping those to real paths). Similarly, it's important to check that other arguments do not permit command injection, but the main vector here is the user input for executable.
Specific steps:
- In
excutePythonRuntime(...)and associated API paths, do not usepythonPathfrom user input directly. - Instead, maintain a hard-coded list of allowed interpreter paths (could be one path, like
"python3"). - In the handler, either always use the default, or if you want to allow selection, only allow a field like
pythonVersion: "python3"/"python3.10"and map that to hard-coded safe paths, not using raw user input. - You will likely need to update the
getExcuteArgsmethod and where it's called, passing a safe path instead of a user value.
Regions to change:
- The definition of
excutePythonRuntimeand calls to it in your controller, to remove user control of the executable path. - Optional: If there's a reason to allow multiple versions, accept only an enumerated, mapped value.
- Remove or replace
pythonPathwherever it comes from an untrusted source.
Suggested changeset
1
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/langchain/LangChainController.java
| @@ -130,7 +130,9 @@ | ||
| throw new RuntimeException("fileName must not be null"); | ||
| } | ||
|
|
||
| List<String> result = this.excutePythonRuntime(requestLangChainParams.pythonPath, | ||
| // Use a whitelisted Python interpreter path (hardcoded for security) | ||
| String safePythonPath = "python3"; // Or use an absolute path like "/usr/bin/python3" | ||
| List<String> result = this.excutePythonRuntime(safePythonPath, | ||
| filePath, requestLangChainParams.query, requestLangChainParams.openKey, schema, | ||
| requestLangChainParams.model, requestLangChainParams.ernieClientId, requestLangChainParams.ernieClientSecret); | ||
| if (CollectionUtils.isEmpty(result)) { | ||
| @@ -250,6 +252,9 @@ | ||
| * @param graphSchema | ||
| * @return | ||
| */ | ||
| // Use only hard-coded python interpreter path for safety | ||
| private static final String PYTHON_INTERPRETER = "python3"; // Or absolute path if desired | ||
|
|
||
| private List<String> excutePythonRuntime(String pythonPath, | ||
| String pythonScriptPath, | ||
| String query, | ||
| @@ -258,7 +263,8 @@ | ||
| String model, | ||
| String ernieClientId, | ||
| String ernieClientSecret) { | ||
| String[] args1 = this.getExcuteArgs(pythonPath, pythonScriptPath, query, openKey, graphSchema, | ||
| // pythonPath param is ignored for security; always use the hardcoded interpreter | ||
| String[] args1 = this.getExcuteArgs(PYTHON_INTERPRETER, pythonScriptPath, query, openKey, graphSchema, | ||
| model, ernieClientId, ernieClientSecret); | ||
| log.info("lang chain execute python command:\n [{}] \n", String.join(" ", args1)); | ||
|
|
||
| @@ -522,6 +528,7 @@ | ||
| String ernieClientId, | ||
| String ernieClientSecret) { | ||
| List<String> argsList = new ArrayList<>(); | ||
| // Only use hardcoded allowed pythonPath for security | ||
| argsList.add(pythonPath); | ||
| argsList.add(pythonScriptPath); | ||
| argsList.add("--query"); |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
| response.setCharacterEncoding("UTF-8"); | ||
| response.setContentType("text/html"); | ||
| String fileName = String.format("%s_%s.schema", graphSpace, graph); | ||
| response.setHeader("Content-Disposition", "attachment;fileName=" + fileName); |
Check warning
Code scanning / CodeQL
HTTP response splitting
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
The best fix is to sanitize the user-provided graphSpace and graph variables before writing them into the Content-Disposition header. As recommended in the background section, this should be done by either escaping or filtering out CR (\r), LF (\n), and other special characters that could prematurely end the header or inject new headers. The simplest safe approach is to remove any characters except a limited safe subset (such as alphanumerics, dashes, underscores), or to replace dangerous characters with safe alternatives.
Implement a helper method (for example, sanitizeForHeader) that replaces or removes any characters that are not part of a safe set (such as [A-Za-z0-9-_]) from the input. Call this function on both graphSpace and graph before constructing fileName. Place the sanitization function in this class (since that's all the code provided). Apply the sanitized values to construct fileName. No new external dependencies are required.
All edits take place inside hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/schema/SchemaController.java. Add the helper method for sanitization (above or near usage), and invoke it in the schemaGroovyExport() method on both graphSpace and graph arguments.
Suggested changeset
1
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/schema/SchemaController.java
| @@ -72,6 +72,18 @@ | ||
| "/{graph}/schema") | ||
| public class SchemaController extends BaseController { | ||
|
|
||
| /** | ||
| * Sanitizes a string for safe usage in HTTP headers (e.g. Content-Disposition), | ||
| * removing any CR, LF, or other disallowed/suspicious characters. | ||
| * Allows only ASCII letters, digits, dash, underscore, dot. | ||
| */ | ||
| private static String sanitizeForHeader(String value) { | ||
| if (value == null) { | ||
| return ""; | ||
| } | ||
| return value.replaceAll("[^A-Za-z0-9._-]", ""); | ||
| } | ||
|
|
||
| public static Logger log = Log.logger(SchemaController.class); | ||
|
|
||
| @Autowired | ||
| @@ -123,7 +135,9 @@ | ||
|
|
||
| response.setCharacterEncoding("UTF-8"); | ||
| response.setContentType("text/html"); | ||
| String fileName = String.format("%s_%s.schema", graphSpace, graph); | ||
| String sanitizedGraphSpace = sanitizeForHeader(graphSpace); | ||
| String sanitizedGraph = sanitizeForHeader(graph); | ||
| String fileName = String.format("%s_%s.schema", sanitizedGraphSpace, sanitizedGraph); | ||
| response.setHeader("Content-Disposition", "attachment;fileName=" + fileName); | ||
| try { | ||
| OutputStream os = response.getOutputStream(); |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
|
Due to the lack of activity, the current pr is marked as stale and will be closed after 180 days, any update will remove the stale label |
This was referenced Jul 8, 2026
Co-authored-by: yeaury <yeaury@qq.com>
- fill standalone loader connection endpoint - validate runtime loader and shortestPath flows - keep Hubble alive across wrapper UI checks - add Playwright dependency for browser smoke
- source Hubble binary legal files from release docs - remove runtime residue before creating the Hubble tarball - add a dist inventory check for required paths and blocked artifacts - support foreground startup without stale daemon output redirection
- keep one concise global follow-up list - stop tracking goal-specific process and evidence files - ignore local task artifacts by default - preserve completed audit evidence locally
- capture the unfinished UI and UX refactor - keep completed legacy and hardening tasks excluded - preserve detailed execution steps in local task records
- disable Kubernetes token endpoints\n- validate pagination and close request clients\n- secure CORS and sanitize exception logging\n- clean up graph listeners and loading state\n- add backend security regression coverage
- add configurable exponential backoff after repeated failures - return HTTP 429 with Retry-After and backend warnings - serialize concurrent attempts per principal and client address - show a deduplicated frontend warning and cover regressions
- bind loader entities to graphspace, graph, and job scopes - protect upload, batch, mutation, and deletion paths - add scoped access regression coverage
- remove unused secondary request wrapper - use default Node and Yarn download sources - align Kotlin runtime dependency versions - reduce expected parser log noise and mark date migration
Files were using a short-form license header that fails the license-eye check. Replace with the full standard Apache 2.0 header consistent with the rest of the project. Also fix all remaining Checkstyle violations in toolchain modules including line length, indentation, operator wrapping, and support for SuppressWarnings filter. Files fixed (License): - hubble-be/.../exception/LoginThrottledException.java - hubble-be/.../service/auth/LoginAttemptGuard.java - hubble-be/.../unit/LoaderScopeControllerTest.java - hubble-be/.../unit/LoginAttemptGuardTest.java - hubble-be/.../unit/PriorityFixTest.java - hubble-fe/src/api/throttleWarning.js - hubble-fe/src/components/RouteErrorBoundary/index.js Files fixed (Checkstyle): - tools/checkstyle.xml - hugegraph-client/.../driver/HugeClientBuilder.java - hugegraph-loader/.../loader/HugeGraphLoader.java - hugegraph-loader/.../loader/task/TaskManager.java - hugegraph-loader/.../loader/executor/LoadOptions.java
- forward only rc-collapse control props across wrappers - normalize rejected algorithm requests for form recovery - preserve success, business-error, and auth contracts - cover all algorithm panels and shared API boundaries
- serialize large graph ids as exact decimal strings - remove the JSON blob BOM and verify parse round trips - expose export actions through keyboard-operable menu items
- make the export button open its dropdown on click - preserve Ant Design keyboard-enabled menu item actions - verify the explicit trigger contract with targeted tests
- keep option loading failures visible with scoped retries - clear stale graph and source-field form values - ignore late responses after context changes - localize recovery states and cover dual-mode contracts
- scope clear copy and symbols to graph data - gate incompatible clone actions with accessible reasons - preserve destructive confirmation and refresh behavior - lock API and action contracts with regression tests
- rebuild Groovy from structured Schema responses - preserve nested userdata and quoted separators - keep legacy Server output unchanged - verify real PD export and replay - add compatibility regression coverage
- project BigInt and JSONbig values safely for JSON display - render table cells without lossy quoting or precision changes - prevent hidden graph fitting and duplicate layout registration
- persist a controlled reason for synchronous Cypher failures - keep async submission and execution failure semantics distinct - close favorite popovers when switching query languages - cover sync, async, and tab-transition regression paths
- expose graph schema export with identity-safe recovery - distinguish Meta loading, empty and failure states - recover vertex and edge detail requests without stale writes - clarify optional template application during graph creation - make graph creation and card actions keyboard accessible
- preserve loading, failure and retry contracts across system pages - prevent stale profile, task and metadata responses from leaking - replace click-only controls with keyboard-accessible actions - localize login, recovery and unknown-route semantics - add focused accessibility and race regression coverage
- add a peer natural-language query tab - block all placeholder execution and network paths - recover rejected query and async task requests - cover zero-call and failure contracts with tests
…path traversal security warnings
- align favorite names with backend constraints - prevent profile validation runtime errors - explain unavailable PD dashboard actions - add focused regression tests and QA report
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hubble2 合入状态与后续 TODO
更新时间：2026-07-04
当前状态：
#12 -> #14 -> #17 -> #16 -> #15顺序完成 review、必要修复、rebase、验证和 merge commit 合入。hubble2最新 head：a3d01a054939fb541fa042e8a9f04256aaf9783f.autonomous/hubble2-pr-merge/，未提交到业务 PR。Server Env:
TODO（按优先级排序）
P0 / Release Blocker
de.schlichtherle.truelicense:truelicense-core:1.33及truelicense-xml-1.33.jar的 AGPL / ASF Category-X 风险。当前只是被 fix(hubble): support upload and shortest path flow #12 的 dependency baseline 暴露出来，尚未移除或替换；release/package sign-off 前必须给出结论。.sha512/.asc。本轮本地 package 没生成 sidecar 文件，因此 fix(hubble): audit binary dist packaging #15 audit 中 checksum/signature 状态为not_checked。P1 / Release Quality
LICENSE/NOTICE/licenses/**/ frontend license inventory 非空，但还没有逐个 jar 对应 license 文件的强校验。P2 / Hygiene
j11 && ...对齐 CI。.worktrees/或明确推荐临时目录 worktree。本轮 PR worktree 放在/private/tmp/hubble2-pr-worktrees/，避免污染主 checkout。