Kris
d7fe152dae
本次提交对 Mattermost 适配器进行了全面升级： 1. 重构为多账号架构，支持同时管理多个 Mattermost 机器人账号 2. 更新安全策略默认配置为配对模式和白名单模式 3. 新增 WebSocket 心跳、重连配置项与连接监控 4. 扩展 Agent 工具支持 pin/unpin、获取反应、搜索消息等操作 5. 重构交互按钮构建逻辑，新增分页与提供商筛选功能 6. 优化 SSRF 防护代码，复用公共工具库实现 7. 新增配置兼容性迁移与可变白名单项检测 8. 完善错误处理与日志输出，添加重复消息去重统计 9. 新增发送临时消息（ephemeral）支持 10. 修复提及检测逻辑，正确处理用户名大小写
54 lines
1.4 KiB
Python
54 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
from urllib.parse import urlparse
|
|
|
|
from yuxi.channels.auth.ssrf_guard import (
|
|
is_private_url as _is_private_url,
|
|
)
|
|
from yuxi.channels.auth.ssrf_guard import (
|
|
validate_url_with_whitelist,
|
|
)
|
|
|
|
|
|
def is_private_url(url: str) -> bool:
|
|
return _is_private_url(url)
|
|
|
|
|
|
def validate_url_safety(url: str, dangerously_allow_private: bool = False) -> tuple[bool, str]:
|
|
if not url:
|
|
return False, "URL is empty"
|
|
|
|
parsed = urlparse(url)
|
|
if parsed.scheme not in ("http", "https"):
|
|
return False, f"Unsupported scheme: {parsed.scheme}"
|
|
|
|
if not dangerously_allow_private and is_private_url(url):
|
|
return False, f"URL points to private/internal network: {parsed.hostname}"
|
|
|
|
return True, "ok"
|
|
|
|
|
|
def validate_mattermost_server_url(url: str, dangerously_allow_private: bool = False) -> str:
|
|
return validate_url_with_whitelist(
|
|
url,
|
|
allowed_hosts=None,
|
|
enforce_https=True,
|
|
allow_private=dangerously_allow_private,
|
|
)
|
|
|
|
|
|
def check_dangerously_allow_private_network(config: dict) -> bool:
|
|
return bool(config.get("network", {}).get("dangerouslyAllowPrivateNetwork", False))
|
|
|
|
|
|
def normalize_mattermost_base_url(url: str) -> str:
|
|
url = url.strip()
|
|
url = url.rstrip("/")
|
|
if url.endswith("/api/v4"):
|
|
url = url[: -len("/api/v4")]
|
|
return url.rstrip("/")
|
|
|
|
|
|
def safe_url_for_driver(url: str) -> str:
|
|
return normalize_mattermost_base_url(url)
|