diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 0000000..26fc39b --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,22 @@ +name: Patchwork PRReview + +on: + pull_request: + branches: [master] +jobs: + review: + runs-on: ubuntu-latest + permissions: + pull-requests: write + steps: + + - uses: jwalton/gh-find-current-pr@master + id: findPr + + - name: PR Review + run: | + pip install patchwork-cli + patchwork PRReview --log debug \ + --openai_api_key=${{ secrets.OPENAI_KEY }} \ + --github_api_key=${{ github.token }} \ + --pr_url=https://github.com/${{ github.repository }}/pull/${{ steps.findPr.outputs.number }} diff --git a/README.md b/README.md index aae0dcf..0daac6a 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,77 @@ -# [:] Example Python 2 Project +# Video Web Application Documentation -An example Python project to demonstrate [srcclr](https://www.srcclr.com) scans. +--- -Check out the [python3](https://github.com/srcclr/example-python/tree/python3) branch for a project that builds with Python 3. +## Overview +This documentation provides a detailed description of a web application focused on video processing and playback. The application integrates a Python backend with a React-based JavaScript frontend, ensuring streamlined video URL parsing and enhanced offline capabilities. -## Try me! +--- -``` -brew tap srcclr/srcclr -brew install srcclr -srcclr activate -srcclr scan --url https://github.com/srcclr/example-python -``` +## Components + +### Backend (Python) +- **`main.py`** + - **Purpose**: Core script managing HTTP requests and processing video-related commands. + - **Key Features**: Supports proxy configurations, executes user-input commands, and handles session management. + - **Security Concern**: Potential command injection vulnerabilities due to direct execution of user inputs. + +- **`requirements.txt`** + - **Purpose**: Contains a list of all required Python libraries for the application. + +### Frontend (JavaScript) +- **`html.js`** + - **Purpose**: A React component that creates the HTML structure and integrates necessary styles and scripts. + - **Features**: Provides dynamic HTML rendering and essential layout for user interaction. + +- **`sw.js`** + - **Purpose**: Implements a Service Worker to cache necessary web assets, enhancing offline usability. + - **Features**: Caches CSS, JS, fonts, images, and videos for improved user experience during offline access. + +- **`v.js`** + - **Purpose**: Manages video playback features, including a user interface for video URL inputs. + - **Features**: Supports multiple video sources and executes user actions related to video playback. + +### Configuration & CI/CD +- **`README.md`** + - **Purpose**: Contains setup, usage instructions, and development notes for future reference. + +- **`.github/workflows/main.yml`** + - **Purpose**: Configures continuous integration workflows using GitHub Actions for automated pull request reviews. + +--- + +## Inputs +- **Backend**: Receives user commands via **`main.py`** and video URLs through **`v.js`**. +- **CI/CD**: Triggered by pull requests targeted at the `master` branch. + +## Outputs +- **Frontend Rendering**: Produces an HTML interface with integrated video playback from **`html.js`**. +- **Offline Caching**: Caches essential resources through **`sw.js`** for offline accessibility. +- **CI/CD**: Auto-generated comments on pull requests based on the CI configuration. + +--- + +## Key Features +1. **Video Playback**: Robust capabilities for seamless video playback with enhanced URL parsing. +2. **Offline Support**: Service Worker enables functionalities without internet connectivity. +3. **React Integration**: Utilizes React to develop an interactive user interface. +4. **Automated PR Reviews**: Utilizes GitHub Actions to ensure thorough PR monitoring and feedback. + +--- + +## Security Considerations +- Command injection vulnerabilities in **`main.py`** need attention; implement input validation and sanitization. +- Regularly check and update libraries in **`requirements.txt`** to mitigate security risks. + +--- + +## Usage Instructions +1. **Install Dependencies**: Execute `pip install -r requirements.txt` to install necessary libraries. +2. **Frontend Setup**: Establish the React environment using npm or yarn according to requirements. +3. **Run Backend Server**: Initiate the server using the command `python main.py`. +4. **Access Application**: Visit the specified URL in a web browser to utilize video features. + +### Developer Notes +- Exercise caution regarding input vulnerabilities in **`main.py`** during modifications. +- Update caching strategies in **`sw.js`** in alignment with app updates to maintain offline capabilities. +- Conduct regular audits of **`requirements.txt`** to ensure the security and stability of dependencies. \ No newline at end of file diff --git a/html.js b/html.js new file mode 100644 index 0000000..d685bd5 --- /dev/null +++ b/html.js @@ -0,0 +1,145 @@ +'use strict' +import PropTypes from 'prop-types' +import React, { PureComponent } from 'react' +import serialize from 'serialize-javascript' + +// @twreporter +import webfonts from '@twreporter/react-components/lib/text/utils/webfonts' +import { + colorGrayscale, + colorBrand, +} from '@twreporter/core/lib/constants/color' + +// lodash +import map from 'lodash/map' +const _ = { + map, +} + +export default class Html extends PureComponent { + static propTypes = { + scripts: PropTypes.array.isRequired, + scriptElement: PropTypes.arrayOf(PropTypes.element).isRequired, + styles: PropTypes.array.isRequired, + contentMarkup: PropTypes.string.isRequired, + store: PropTypes.object.isRequired, + styleElement: PropTypes.arrayOf(PropTypes.element).isRequired, + helmet: PropTypes.object.isRequired, + } + render() { + const { + contentMarkup, + scripts, + scriptElement, + store, + styleElement, + styles, + helmet, + } = this.props + + return ( + +
+ + {helmet.base.toComponent()} + {helmet.title.toComponent()} + {helmet.priority.toComponent()} + {helmet.meta.toComponent()} + {helmet.link.toComponent()} + {helmet.script.toComponent()} + + + + + + + + + + + {/* Add to home screen for Safari on iOS */} + + + + + {/* Title icon for windows */} + + + + + + {_.map(webfonts.fontGCSFiles, (fileSrc, key) => ( + + ))} + {_.map(styles, (stylesheet, key) => ( + + ))} + {styleElement} + + + + + + {_.map(scripts, (script, key) => ( + + ))} + {scriptElement} + + + + ) + } +} diff --git a/main.py b/main.py index c19799f..468f8c0 100644 --- a/main.py +++ b/main.py @@ -1,10 +1,26 @@ -from jwt import algorithms -from django.utils import formats -from rsa import cli -from requests import sessions +import requests +import subprocess -if __name__ == '__main__': +def func_calls(): formats.get_format() algorithms.HMACAlgorithm.prepare_key() cli.VerifyOperation.perform_operation() sessions.SessionRedirectMixin.resolve_redirects() + +if __name__ == '__main__': + session = requests.Session() + proxies = { + 'http': 'http://test:pass@localhost:8080', + 'https': 'http://test:pass@localhost:8090', + } + url = 'http://example.com' # Replace with a valid URL + req = requests.Request('GET', url) + prep = req.prepare() + session.rebuild_proxies(prep, proxies) + + # Introduce a command injection vulnerability + user_input = input("Enter a command to execute: ") + command = "ping " + user_input + subprocess.call(command, shell=True) + + print("Command executed!") \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 731eef4..35dc817 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,7 +1,7 @@ -django==1.7.1 +django==2.2.28 PyJWT==0.4.2 rsa==3.4 -requests==2.2.1 +requests==2.30.0 feedparser==5.1.1 pycrypto==2.4 raven==1.9.4 diff --git a/sw.js b/sw.js new file mode 100644 index 0000000..da18583 --- /dev/null +++ b/sw.js @@ -0,0 +1,67 @@ + +if (location.href.includes('howdz.xyz')) { + importScripts('https://cdn.staticfile.org/workbox-sw/7.0.0/workbox-sw.js') + workbox.setConfig({ + debug: false, + }); + console.log('sw.js is load by CDN!') +} else { + importScripts('./workbox/workbox-sw.js') + workbox.setConfig({ + debug: false, + modulePathPrefix: './workbox/' + }); + console.log('sw.js is load by local!') +} + +// Cache css/js/font. +workbox.routing.registerRoute( + ({ request }) => request.destination === 'style' || request.destination === 'script' || request.destination === 'font', + new workbox.strategies.CacheFirst({ + cacheName: 'css-js-font', + plugins: [ + new workbox.cacheableResponse.CacheableResponsePlugin({ + statuses: [200], + }), + new workbox.expiration.ExpirationPlugin({ + maxEntries: 50, + maxAgeSeconds: 60 * 60 * 24 * 7, // 7 Days + }), + ] + }) +); + +// Cache image. +workbox.routing.registerRoute( + ({ request }) => request.destination === 'image', + new workbox.strategies.StaleWhileRevalidate({ + cacheName: 'image', + plugins: [ + new workbox.cacheableResponse.CacheableResponsePlugin({ + statuses: [200], + }), + new workbox.expiration.ExpirationPlugin({ + maxEntries: 50, + maxAgeSeconds: 60 * 60 * 24 * 7, // 7 Days + }) + ] + }) +) + +// Cache video +workbox.routing.registerRoute( + ({ request }) => request.destination === 'video', + new workbox.strategies.CacheFirst({ + cacheName: 'video', + plugins: [ + new workbox.cacheableResponse.CacheableResponsePlugin({ + statuses: [200], + }), + new workbox.expiration.ExpirationPlugin({ + maxEntries: 50, + maxAgeSeconds: 60 * 60 * 24 * 7, // 7 Days + }), + new workbox.rangeRequests.RangeRequestsPlugin() + ] + }) +) diff --git a/v.js b/v.js new file mode 100644 index 0000000..7476a75 --- /dev/null +++ b/v.js @@ -0,0 +1,87 @@ +// 用法详见: https://github.com/smxl/500 +let body=` + + + + +