绝尘
f1a06732fd
- 后端: Cargo.toml reqwest0.12(json/gzip/brotli native-tls对齐df-ai) + http.rs(handler+SSRF三层防御 validate_url/resolve_and_check/重定向≤3跳每跳校验) + tool_registry register_http_tools + 基线28→29 - 前端: useToolCard formatHttpResult + ToolCard渲染(method/url/status/body折叠/截断) + HIGH_RISK_TOOLS + confirmHighHttp + i18n - SSRF: localhost/私有IP(127/10/172.16/192.168/169.254云元数据/100.64CGNAT/≥224/IPv6保留)拒绝 + DNS resolve校验防重绑定 + 重定向每跳重校验 - 审批: High(统一保守 GET也审批 防漏写操作) - 截断: 响应50KB(T-05)+ 请求1MB + 超时1-60s默认30
49 lines
1.8 KiB
TOML
49 lines
1.8 KiB
TOML
[package]
|
|
name = "devflow"
|
|
version = "0.1.0"
|
|
description = "DevFlow Desktop App"
|
|
authors = [""]
|
|
edition = "2021"
|
|
|
|
[lib]
|
|
name = "devflow_lib"
|
|
crate-type = ["staticlib", "cdylib", "rlib"]
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
|
|
[dependencies]
|
|
tauri = { version = "2", features = [] }
|
|
tauri-plugin-dialog = "2"
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-window-state = "2"
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio.workspace = true
|
|
anyhow.workspace = true
|
|
tracing.workspace = true
|
|
chrono.workspace = true
|
|
|
|
# 后端 crate
|
|
df-types = { path = "../crates/df-types" }
|
|
df-storage = { path = "../crates/df-storage" }
|
|
df-workflow = { path = "../crates/df-workflow" }
|
|
df-nodes = { path = "../crates/df-nodes" }
|
|
df-execute = { path = "../crates/df-execute" }
|
|
df-ai = { path = "../crates/df-ai" }
|
|
df-ideas = { path = "../crates/df-ideas" }
|
|
df-project = { path = "../crates/df-project" }
|
|
futures = "0.3"
|
|
# write_file base64 编码:写二进制/非 UTF-8 文件(图片/PDF/Excel 等)
|
|
base64 = "0.22"
|
|
# validate_path URL 解码:防 %2e%2e 等 URL 编码绕过路径遍历检查(BUG-260617-03)
|
|
percent-encoding = "2"
|
|
# keyring:密钥解析下沉到 df-storage(workspace 统一声明平台 feature),
|
|
# src-tauri 经 workspace 引用(转发壳 build_provider_for 不直接碰 keyring,但旧路径/兼容保留)。
|
|
# 根因见 docs/09-问题排查/aichat-apikey-401排查-2026-06-15.md
|
|
keyring = { workspace = true }
|
|
# http_request AI 工具:结构化 HTTP(GET/POST/...)。
|
|
# 复用 df-ai 同款 reqwest 0.12(同版本锁定,避免双 TLS 后端)。默认 native-tls(与 df-ai 一致),
|
|
# 启用 json(响应解析)/gzip/brotli(透明解压,常见 API 必备)。重定向手动接管(见 http.rs SSRF)。
|
|
reqwest = { version = "0.12", features = ["json", "gzip", "brotli"] }
|