qing
7467e7bd42
docs: 整理文档——修复全部 file:// 失效链接、补齐缺失模块 README
...
- 将 7 个文档中的 mac 绝对路径链接（file:///Users/qingsong/...）转换为仓库相对路径，
并修正错误目标：aibox 入口 main.py → aibox.py、pymsg C++ 实现 → libmsg/inc/us/Msg.hpp、
bot4cj cpp/cnn → cuda
- 主 README 补 liblogc 基础库条目与 confs2 归档说明，安装顺序补 ca
- 新增 liblogc / libtry / confs2 / 3d / memdb README
- 同步 db2 脚本迁移（db/create_sqlite3.sql → db2/scripts/）导致的失效引用
2026-08-10 15:48:29 +00:00
qing
685c5c1754
refactor(libmsg): 将审计结论合入代码注释并精简审计报告
...
- 在 libmsg 各头文件修复位置补充 [libmsg-audit <编号>] 标签（27 处），
覆盖 16 条安全审计发现（P0-1/P0-2/P1-1~3/P2-1~8/P3-1~3），
将已完成修复锚定到源码
- 从审计文档删除 335 行逐条详细发现（问题描述/修复方案/触发场景/代码块），
替换为 16 行「已解决发现」紧凑台账 + 源码定位指针
- 文档保留：严重等级表、修复进度汇总、已有安全机制、已知限制 L-1~L-12、
变更记录、审计结论
2026-08-10 01:26:10 +08:00
qing
e2f05f9a43
fix(libmsg): security audit round 4 - eliminate residual race + atomic server_fd
...
- P1-3: introduce ConnectionLock (mutex + atomic active) to close the residual
CWE-362 race where _remove_client closes fd before reply/broadcast acquires
the lock; senders now check active after locking and abort if fd was closed
- P2-7: make _server_fd std::atomic<int> to remove the data-race UB between
stop() and _event_loop
- P2-8: validate on_message is non-null in MsgServer::start()
- P3-2: distinguish missing _route vs wrong-typed _route in RpcServer
- P3-3: set TCP_NODELAY/SO_SNDTIMEO before registering fd in _clients
- doc: add SO_SNDTIMEO precondition note to pmsg_send
2026-08-07 21:27:05 +08:00
qing
63c22a3d60
fix(libmsg): security audit round 3 - add server send timeout + harden RPC validation
2026-08-07 21:13:14 +08:00
qing
3c50a862d3
fix(libmsg): complete security audit round 2 - fix P0 race + harden input validation
...
- P0: fix _close_all_clients() race condition (CWE-362) - hold per-connection send_lock
before close() to prevent messages being sent to wrong client after fd reuse
- P2: add comprehensive input validation for all public APIs
(timeout/port/workers/max_connections/batch_size etc. bounds checking)
- P2: add UTF-8 payload validation (isValidUtf8) aligning with Python pymsg behavior,
rejecting overlong encodings, surrogate pairs, truncated/invalid sequences
- P2: document pmsg_recv(int) precondition and recommend deadline mode
- add constructor validation for MsgClient/MsgServer/AsyncQueue/RpcClient/RpcServer
- add add_route() validation for empty route name and null handler
- update security audit report with round 2 findings and fixes (8 issues total, 100% fixed)
2026-08-07 21:01:34 +08:00
qing
a4611ec737
docs(security): 新增 libmsg 安全审计报告，更新文档索引
...
新增 docs/security/libmsg_SECURITY_AUDIT_20260806.md，记录 SAST
扫描发现的 3 个漏洞（CWE-362/400/209）及对应修复方案，更新
docs/INDEX.md 加入 libmsg 审计文档入口。
2026-08-06 17:18:27 +00:00
qing