tao.chen
9233d99237
Codex review of #34 surfaced that folder names containing ``_`` (matches any single character in SQL LIKE) or ``%`` (matches any sequence) would leak across sibling paths when used as parent_path / descendant_prefix. Two endpoints were vulnerable: - list_workspace_directories (pre-existing, line 780/781, 814/815) - list_scripts (added in #34, line 1101/1102) Both had four LIKE calls total, all unescaped. ``safe_directory_name`` allows ``_`` and rejects nothing relevant, so any user-created directory named e.g. ``foo_bar`` would have its queries silently match ``fooXbar/...`` paths too. Fix: add ``escape="\\"`` to every .like() / ~.like() call so MySQL emits ``ESCAPE '\\'``. SQLAlchemy doubles the escape character for SQL string literals (renders as ``ESCAPE '\\\\'``); test asserts the rendered form appears for both positive and negated clauses in each endpoint. Also touched get_workspace_tree's `like(like_prefix)` (line 707) and delete_workspace_directory's `like(f"{child_prefix}%")` (line 1017) — the prefixes are server-built so technically not user-controllable, but defense in depth costs nothing. Verified: pytest 52 passed (50 + 2 new ESCAPE assertions).
Backend
统一 FastAPI 管理服务。包含用户、Workspace、脚本、稳定版本、调度定义、
立即运行以及 S3 对象接口。原 platform_api 与 storage_api 已在此
模块合并，外部 REST 契约保持不变。
底层走的是 common.storage.AsyncStorageBackend 抽象，按
settings.storage_backend 切换 s3 / local 两种实现。