spark-store-project/spark-store
15
0
Fork 0
mirror of https://gitee.com/spark-store-project/spark-store synced 2026-09-20 21:50:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security/robustness): 清理 update-center 调试日志 + cancel-install id 校验

Browse Source 
- update-center/index.ts: 引入 pino logger，将约 30 处 console.log(含 [DEBUG] 前缀及敏感路径)
  替换为 logger.debug（生产默认 info 级不打印，消除敏感信息泄露）
- install-manager.ts: cancel-install 增加 id 整数类型校验(typeof number && isInteger)，防御非法输入
- PR 审查其余 5 项经代码实证为误报：JSON.parse 已有 try-catch、activeDownloadCount 的 mkdir/axios
  均在 try 内且 finally 必执行、check/remove-installed 已用 parseAppPayload 做 PKGNAME_PATTERN 校验、
  origin 已枚举归一化、initializeUpdateCenter 已有单例守卫；async handler 顶层 try-catch 因 Electron
  主进程默认 unhandledRejection 不崩溃且改动面大(19 handler)风险高，未改
This commit is contained in:
xiyidaiwa
2026-08-13 23:37:03 +08:00
parent 3cedd0c517
commit 7bad39a796
3 changed files with 34 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
debian/changelog
Vendored
+1 -1
View File
@@ -1,4 +1,4 @@
spark-store (5.2.1.8-test) UNRELEASED; urgency=medium
spark-store (5.2.1.9-test) UNRELEASED; urgency=medium
* Initial release. (Closes: #nnnn) <nnnn is the bug number of your ITP>