fix: 修复socket绑定到所有网络接口的安全问题 (CodeQL)#351
Merged
CodeCasterX merged 1 commit into3.5.xfrom Oct 27, 2025
Merged
Conversation
将 get_free_tcp_port() 函数中的socket绑定地址从空字符串 '' (等同于 0.0.0.0) 改为 _LOCAL_HOST (127.0.0.1),避免将socket暴露到所有网络接口。 这修复了 CodeQL 扫描警报 #3 (CWE-200: 信息泄露),消除了中等严重程度的安全风险。 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
surpercodehang
approved these changes
Oct 27, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 相关问题 / Related Issue
Issue 链接 / Issue Link:
📋 变更类型 / Type of Change
📝 变更目的 / Purpose of the Change
修复 CodeQL 代码扫描发现的安全问题:Binding a socket to all network interfaces (CWE-200: 信息泄露)
问题描述:
在
framework/fit/python/fitframework/utils/tools.py:56的get_free_tcp_port()函数中,socket 使用空字符串''作为绑定地址,这等同于0.0.0.0,会将 socket 绑定到所有可用的网络接口,存在安全风险。安全风险:
Fix Description:
Fixed the CodeQL code scanning security issue: Binding a socket to all network interfaces (CWE-200: Information Exposure)
The
get_free_tcp_port()function was binding socket to all interfaces using empty string''(equivalent to0.0.0.0), which exposes the socket to all network interfaces.📋 主要变更 / Brief Changelog
get_free_tcp_port()函数中的 socket 绑定地址从''改为_LOCAL_HOST(127.0.0.1)_LOCAL_HOST,保持代码一致性Main Changes:
''to_LOCAL_HOST(127.0.0.1) inget_free_tcp_port()function_LOCAL_HOSTconstant for code consistency🧪 验证变更 / Verifying this Change
测试步骤 / Test Steps
功能验证 / Functional Verification
get_free_tcp_port()函数依然能够正确获取系统分配的空闲端口号get_http_server_port()和get_https_server_port())功能正常安全验证 / Security Verification
兼容性验证 / Compatibility Verification
测试覆盖 / Test Coverage
📸 截图 / Screenshots
修改前 (不安全):
修改后 (安全):
✅ 贡献者检查清单 / Contributor Checklist
基本要求 / Basic Requirements:
代码质量 / Code Quality:
测试要求 / Testing Requirements:
mvn -B clean package -Dmaven.test.skip=true,elsa README 中的编译检查 / Basic checks passmvn clean install/ Unit tests pass文档和兼容性 / Documentation and Compatibility:
📋 附加信息 / Additional Notes
影响范围 / Impact Scope
直接影响的函数:
framework/fit/python/fitframework/utils/tools.py::get_free_tcp_port()间接影响的调用者:
framework/fit/python/plugin/fit_py_server_http/http_utils.py::get_http_server_port()framework/fit/python/plugin/fit_py_server_http/http_utils.py::get_https_server_port()功能影响: 无影响,端口分配功能完全正常
向后兼容性: 100% 向后兼容
CodeQL 警报信息 / CodeQL Alert Information
审查者注意事项 / Reviewer Notes:
这是一个简单但重要的安全修复:
Reviewer please note: