mirror of
https://github.com/storytold/lightcraft.git
synced 2026-10-24 10:09:01 -06:00
Dylan M. Taylor
68d5118a9d
Resolve and validate command-line path arguments before use, enforce HTTPS at download sinks, and confirm path containment. Hardens local codegen/fetch tools against path-traversal and command-argument-injection findings.
31 lines
1.0 KiB
Python
31 lines
1.0 KiB
Python
#!/usr/bin/env python3
|
|
"""lcb.py FILE.jsonl — run control requests from a JSON-lines file ({"method":..., "params":...} or {"sleep": s})."""
|
|
import json, socket, sys, time
|
|
from pathlib import Path
|
|
|
|
|
|
def _jsonl_path(arg):
|
|
"""Resolve the CLI file argument; require an existing regular file."""
|
|
path = Path(arg).resolve()
|
|
if not path.is_file():
|
|
sys.exit(f"not a readable file: {arg}")
|
|
return path
|
|
|
|
def call(method, params):
|
|
s = socket.create_connection(("127.0.0.1", 7980), timeout=180)
|
|
s.sendall((json.dumps({"id": 1, "method": method, "params": params}) + "\n").encode())
|
|
buf = b""
|
|
while not buf.endswith(b"\n"):
|
|
c = s.recv(1 << 20)
|
|
if not c: break
|
|
buf += c
|
|
return json.loads(buf)
|
|
for line in open(_jsonl_path(sys.argv[1])):
|
|
line = line.strip()
|
|
if not line or line.startswith("#"): continue
|
|
r = json.loads(line)
|
|
if "sleep" in r:
|
|
time.sleep(r["sleep"]); continue
|
|
out = call(r["method"], r.get("params", {}))
|
|
print(r["method"], json.dumps(out)[:160])
|