koishijs / koishijs/koishi-plugin-github
Bug: render error for markdown
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 9
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
> Well, I have learnt more...........own go-cqhttp without the adorable Koishi.
I actually think one of us (probably it's me) doesn't completely understand the source code. Let's take a look at this part.
\`\`\`go
if len(byteKey) == 0 {
log.Infof("密码加密已启用, 请输入Key对密码进行解密以继续: (Enter 提交)")
cancel := make(chan struct{}, 1)
state, _ := term.GetState(int(os.Stdin.Fd()))
go func() {
select {
case <-cancel:
return
case <-time.After(time.Second * 45):
log.Infof("解密key输入超时")
time.Sleep(3 * time.Second)
_ = term.Restore(int(os.Stdin.Fd()), state)
os.Exit(0)
}
}()
byteKey, _ = term.ReadPassword(int(os.Stdin.Fd()))
cancel <- struct{}{}
} else {
log.Infof("密码加密已启用, 使用运行时传递的参数进行解密,按 Ctrl+C 取消.")
}
encrypt, _ := os.ReadFile("password.encrypt")
ph, err := PasswordHashDecrypt(string(encrypt), byteKey)
if err != nil {
log.Fatalf("加密存储的密码损坏,请尝试重新配置密码")
}
copy(base.PasswordHash[:], ph)
\`\`\`
In my understanding, it would first check if there's an argument that provides the 'password' to decrypt the login password. If so, use it to decrypt the password, else wise, ask the user to input the password in the terminal. This would solve the problem that Masnn mentioned: the 'password' to decrypt the login password is not stored and is memorized by the admin, so only if the user inputs the password in the terminal or provide it through arguments, gocqhttp would be able to decrypt the password. Elsewise, neither gocqhttp nor other software would be able to decrypt it.
-----------
Also, I'd like to share some situations when we need it:
1. It would be helpful if Koishi backend has some critical vulnerability for arbitrary file reading.
2. I've seen many users directly send their `config.yml` out when they are asking for help. This would prevent accidental password leaks.
3. When the server was cracked, this would stop the hacker from stealing the account. Ofc this won't work if the hacker get permission of reading memory, but it still works when the hacker cannot get root permission.
4. It protects the user who doesn't use `auth` plugin.
---------------
The workflow can be easily simplified with the password args. We just need to (fake code):
\`\`\`js
pwd_encrypt = ask the user for the password.
if( file "password.encrypt" not exists ){
pwd = ask the user for qq password
write pwd to config.yml and enable encrypt option
start process 'gocqhttp'
pass the password to standard input
wait until it exits
}
remove the password in config.yml, save it.
start process 'gocqhttp' with arg `--pwd=${pwd_encrypt}`
\`\`\`
---------
Anyway, I think that's a good feature and I'd like to leave the issue here. You contributors take the final determination if implement this feature or not.
----------

Sincerely,
MicroBlock
this markdown string would cause a render error in the message like this:

dont know if this is intentional or not
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The report names no source file, test, or rendering entry point; it provides only a markdown body and a screenshot of the error. Start by locating the GitHub message-rendering path and reproduce the failure with the supplied string, then add a regression test and confirm the content renders without an error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, markdown, typescript
- Domain
- content
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100