Skip to content

feat: add palette config types for plugin color selection #4650

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bylkuse wants to merge 20 commits into
base: master
Choose a base branch
from

Remove 'clear' entry from common.json

f712a4d
Select commit
Loading
Failed to load commit list.
Open

feat: add palette config types for plugin color selection #4650

Remove 'clear' entry from common.json
f712a4d
Select commit
Loading
Failed to load commit list.
Sourcery AI / Sourcery review failed Feb 23, 2026 in 43s

❌ Found 4 blocking security issues

Sourcery found 4 blocking security issues:

  • astrbot/core/computer/booters/local.py:75-83 - Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
  • astrbot/core/computer/booters/local.py:85-93 - Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
  • astrbot/core/computer/booters/local.py:114-119 - Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
  • astrbot/core/computer/booters/local.py:115 - Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.
View more details on Sourcery AI