fix(scripts): convert macOS setup scripts from CRLF to LF - #195
fix(scripts): convert macOS setup scripts from CRLF to LF#195openjiuwen-sync-bot[bot] wants to merge 1 commit into
Conversation
Issue #1234 reports that shell scripts under docs/zh/2.安装指导/本地安装/script/setup_scripts_macos/ use CRLF line terminators, making them unexecutable on Linux (`\r` interpreted as a literal carriage return, bash refuses to run or behaves erratically). The 7 affected files were edited on Windows and committed with CRLF; the sibling setup_scripts_linux/ directory and the scripts/ tree are already clean LF, so this normalises only the macOS directory to match. Converted (CRLF → LF): - check_curl.sh - check_git.sh - check_mysql.sh - check_nodejs.sh - check_python.sh - fetch_codes.sh - setup.sh No content changes — line endings only. Closes #1234 Co-Authored-By: AtomCode (GLM-5.2) <noreply@atomgit.com>
|
|
|
head_sha: 变更摘要此 PR 将 主要改动
|
|
head_sha: 代码审查我已经完成了对所有 7 个文件的全面审查。以下是我的发现： 逐文件审查确认check_curl.sh — 82 行，纯 check_git.sh — 102 行，纯 check_mysql.sh — 172 行，纯 check_nodejs.sh — 179 行，纯 check_python.sh — 475 行，纯 fetch_codes.sh — 113 行，纯 setup.sh — 2197 行，纯 结论此 diff 为纯粹的 CRLF→LF 换行符转换，无任何逻辑变更、无内容变更、无新增代码。Grep 确认工作区 7 个文件中已无 审查结果：无问题发现。
整体风险判断：无风险。 这是一个安全、干净的换行符规范化变更，建议合入。
💬 仅评论 |
|
head_sha:
|
![openjiuwen-collaboration-bot[bot]](https://avatars.githubusercontent.com/u/264091041?s=60&v=4){kind=small}
| FETCH_SCRIPT="${WORK_HOME}/fetch_codes.sh" | ||
| check_file "$FETCH_SCRIPT" | ||
|
|
||
| if ! retry_execute 3 10 "Fetch code" "bash '$FETCH_SCRIPT' '$GIT_BRANCH'"; then |
There was a problem hiding this comment.
head_sha: 3ecb3abf953bf2bb71752d4bdf5052c38d52fd44
🟡 Medium Priority
changed line 1556 及 retry_execute 函数（line 122–153）→ 受影响的边界：--branch= 命令行参数 → 失效模式: GIT_BRANCH 来自用户输入的 --branch=VALUE（line 1413），仅做了非空校验（line 1415），未过滤 shell 元字符（如 '、;、$() 等）。该值在第 1556 行以单引号包裹拼入传给 retry_execute 的命令字符串："bash '$FETCH_SCRIPT' '$GIT_BRANCH'"，随后在 retry_execute 的 line 135 被 eval 执行。如果攻击者传入 --branch="main'; rm -rf /; echo '"，单引号会提前闭合，导致注入的命令被执行。
触发条件：脚本被自动化系统（CI/CD、webhook）以外部可控的分支名调用时，风险显著升高。手动运行时攻击者即用户本人，风险较低。
建议：方案一（推荐）：不再将 $GIT_BRANCH 拼入 eval 字符串，改为直接在 retry_execute 中支持数组形式的命令传参，避免 eval。方案二（最小改动）：在 --branch= 解析处增加字符白名单校验，例如 [[ "$GIT_BRANCH" =~ ^[a-zA-Z0-9._/-]+$ ]]，拒绝包含 shell 元字符的输入。
|
head_sha:
|
2 participants
Paired: GitHub #195 ↔ GitCode !1775
What & Why
Closes #1234.
The 7 shell scripts under
docs/zh/2.安装指导/本地安装/script/setup_scripts_macos/were committedwith CRLF line terminators (edited on Windows). On Linux,
\risinterpreted as a literal carriage return — bash either refuses to run
the script or behaves erratically (phantom characters, broken
if/thenparsing, heredoc corruption).The sibling directory
setup_scripts_linux/and thescripts/treeare already clean LF, so this normalises only the macOS directory to
match — no behaviour change, no content change, line endings only.
Files converted (CRLF → LF)
check_curl.shcheck_git.shcheck_mysql.shcheck_nodejs.shcheck_python.shfetch_codes.shsetup.sh7 files, 3314 line-ending flips. Diff is purely
\r\n→\n.Verification
find setup_scripts_macos -name '*.sh' -exec grep -l $'\r' {} \;→ empty (no CRLF remaining) ✅
file setup.shreports "Bourne-Again shell script ... executable"(previously: "...with CRLF line terminators") ✅
-CRLF +LFline pair is byte-identicalmodulo the trailing
\r.