koishijs / koishijs/koishi-plugin-github

Bug: render error for markdown

Open
#21 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
9
Forks
5
PR merge metrics
No merged PRs in 30d

Description


> Well, I have learnt more...........own go-cqhttp without the adorable Koishi.

I actually think one of us (probably it's me) doesn't completely understand the source code. Let's take a look at this part.

\`\`\`go
	if len(byteKey) == 0 {
		log.Infof("密码加密已启用, 请输入Key对密码进行解密以继续: (Enter 提交)")
		cancel := make(chan struct{}, 1)
		state, _ := term.GetState(int(os.Stdin.Fd()))
		go func() {
			select {
			case <-cancel:
				return
			case <-time.After(time.Second * 45):
				log.Infof("解密key输入超时")
				time.Sleep(3 * time.Second)
				_ = term.Restore(int(os.Stdin.Fd()), state)
				os.Exit(0)
			}
		}()
		byteKey, _ = term.ReadPassword(int(os.Stdin.Fd()))
		cancel <- struct{}{}
	} else {
		log.Infof("密码加密已启用, 使用运行时传递的参数进行解密,按 Ctrl+C 取消.")
	}

	encrypt, _ := os.ReadFile("password.encrypt")
	ph, err := PasswordHashDecrypt(string(encrypt), byteKey)
	if err != nil {
		log.Fatalf("加密存储的密码损坏,请尝试重新配置密码")
	}
	copy(base.PasswordHash[:], ph)
\`\`\`

In my understanding, it would first check if there's an argument that provides the 'password' to decrypt the login password. If so, use it to decrypt the password, else wise, ask the user to input the password in the terminal. This would solve the problem that Masnn mentioned: the 'password' to decrypt the login password is not stored and is memorized by the admin, so only if the user inputs the password in the terminal or provide it through arguments, gocqhttp would be able to decrypt the password. Elsewise, neither gocqhttp nor other software would be able to decrypt it.

-----------

Also, I'd like to share some situations when we need it:
1. It would be helpful if Koishi backend has some critical vulnerability for arbitrary file reading.
2. I've seen many users directly send their `config.yml` out when they are asking for help. This would prevent accidental password leaks.
3. When the server was cracked, this would stop the hacker from stealing the account. Ofc this won't work if the hacker get permission of reading memory, but it still works when the hacker cannot get root permission.
4. It protects the user who doesn't use `auth` plugin.

---------------

The workflow can be easily simplified with the password args. We just need to (fake code):
\`\`\`js
pwd_encrypt = ask the user for the password.
if( file "password.encrypt" not exists ){
    pwd = ask the user for qq password
    write pwd to config.yml and enable encrypt option
    start process 'gocqhttp'
    pass the password to standard input
    wait until it exits
}
remove the password in config.yml, save it.
start process 'gocqhttp' with arg `--pwd=${pwd_encrypt}`
\`\`\`

---------

Anyway, I think that's a good feature and I'd like to leave the issue here. You contributors take the final determination if implement this feature or not.

----------

![(5@ DXGO16ACC_EC{MO2FSN](https://user-images.githubusercontent.com/66859419/215329111-69757232-2161-4dca-968a-feb863c6f469.jpeg)


Sincerely,
MicroBlock


this markdown string would cause a render error in the message like this:

image

dont know if this is intentional or not

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names no source file, test, or rendering entry point; it provides only a markdown body and a screenshot of the error. Start by locating the GitHub message-rendering path and reproduce the failure with the supplied string, then add a regression test and confirm the content renders without an error.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, markdown, typescript
Domain
content
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.