fix(download): 修复系统代理和ghproxy同时启用#2233
Open
ShadowLemoon wants to merge 1 commit into
Open
Conversation
Contributor
📝 Walkthrough概览
变更HTTP 下载机制重构
估算代码审查工作量🎯 3 (中等) | ⏱️ ~20 分钟 兔子的诗
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/one_dragon/utils/http_utils.py`:
- Around line 58-59: Validate the download_url scheme before calling opener.open
to prevent non-HTTP(S) schemes (e.g., file://) from being used: parse
download_url (via urllib.parse.urlparse) and ensure url.scheme is "http" or
"https", otherwise raise an exception or log and abort; update the code path
around the existing download logic (the variables/functions download_url,
opener.open, and the code that calls urllib.request.build_opener/ProxyHandler)
to perform this check early and fail fast if the scheme is invalid.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 59e1b64d-965c-45ef-a2b5-28e8538770d4
📒 Files selected for processing (1)
src/one_dragon/utils/http_utils.py
Comment on lines
+58
to
+59
| request = urllib.request.Request(download_url) | ||
| with opener.open(request, timeout=60) as response, save_path.open('wb') as file: |
Contributor
There was a problem hiding this comment.
建议校验 download_url 的协议方案，防止非预期的 file:// 等 scheme 被访问。
urllib.request.build_opener(ProxyHandler(...)) 默认会包含 FileHandler，因此 opener.open() 可接受 file:// 或其他自定义 scheme 的 URL。若 YAML 配置被篡改或意外填入非 HTTP(S) 地址，将导致本地文件被读取。Ruff S310 已对此发出警告。
🛡️ 建议：在发起请求前校验 URL scheme
+ from urllib.parse import urlparse
+ parsed = urlparse(download_url)
+ if parsed.scheme not in ('http', 'https'):
+ raise ValueError(f"不支持的下载协议：{parsed.scheme}")
+
request = urllib.request.Request(download_url)
with opener.open(request, timeout=60) as response, save_path.open('wb') as file:🧰 Tools
🪛 Ruff (0.15.12)
[error] 58-58: Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
(S310)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/one_dragon/utils/http_utils.py` around lines 58 - 59, Validate the
download_url scheme before calling opener.open to prevent non-HTTP(S) schemes
(e.g., file://) from being used: parse download_url (via urllib.parse.urlparse)
and ensure url.scheme is "http" or "https", otherwise raise an exception or log
and abort; update the code path around the existing download logic (the
variables/functions download_url, opener.open, and the code that calls
urllib.request.build_opener/ProxyHandler) to perform this check early and fail
fast if the scheme is invalid.
Collaborator
Author
There was a problem hiding this comment.
能不能直接startswith http校验
Contributor
There was a problem hiding this comment.
@ShadowLemoon，可以用 startswith，但建议用元组形式来精确匹配，避免误匹配 httpfoo:// 这类异常 scheme：
if not download_url.startswith(('http://', 'https://')):
raise ValueError(f"不支持的下载协议：{download_url}")
request = urllib.request.Request(download_url)
with opener.open(request, timeout=60) as response, save_path.open('wb') as file:这样既不需要额外 import，也能精确区分 http:// 和 https://，比 startswith('http') 更严谨（纯 startswith('http') 也会放行 httpxxx:// 类格式）。
🧠 Learnings used
Learnt from: kawayiYokami
Repo: OneDragon-Anything/ZenlessZoneZero-OneDragon PR: 1931
File: src/one_dragon/base/controller/pc_controller_base.py:64-71
Timestamp: 2026-01-13T18:59:27.574Z
Learning: 当成员使用 property 装饰器将方法变为只读属性时，应通过属性访问而非调用，示例：self.game_win.is_win_active 而非 self.game_win.is_win_active()。在进行代码审查时应检查对带有 property 的成员的访问方式是否正确，并避免用括号调用属性。
Learnt from: JoshCai233
Repo: OneDragon-Anything/ZenlessZoneZero-OneDragon PR: 2219
File: src/one_dragon_qt/view/standalone_app_run_interface.py:210-215
Timestamp: 2026-05-03T07:24:35.764Z
Learning: When implementing Chinese (pinyin) string sorting on Windows in this PySide6/Qt codebase, avoid relying on `QCollator(Q...Locale(Language.Chinese, Country.China))` for correct pinyin collation. Instead, use Python’s `locale` collation via `locale.setlocale(locale.LC_COLLATE, "zh_CN.UTF-8")` and `locale.strxfrm(...)` to get correct pinyin ordering. Also, never use a bare `except:` for this logic—narrow it to `except locale.Error:` (or otherwise catch the specific expected exception type).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
发布说明
Bug Fixes
性能改进