mirror of
https://github.com/larksuite/cli.git
synced 2026-09-14 18:42:53 +08:00
zhaojunlin0405
fda8d7cdae
* fix: reduce vulnerable dependencies while retaining Go 1.23 * fix(imageconfig): own the standard-library codec registration Decode dispatches PNG, JPEG and GIF to image.DecodeConfig, which only answers for codecs some package in the binary has imported. The package did not import them; it worked because all five call sites still carried blank imports left over from calling image.DecodeConfig directly. Those files no longer mention image at all, so the imports now read as dead weight and the next tidy-up removes them -- silently for base, calendar and doc-media, as a hard command failure for sheets +set-cell-image and docs remote images. Register the three codecs where they are used and drop the call-site imports. The guard lives in deptest because that package imports no codec of its own and can therefore prove the ownership. * fix(imageconfig): keep WebP dimensions readable when the final pad byte is absent readWebP required every chunk to fit inside the container *with* its even-padding byte, and required the container size itself to be even, before it looked at the chunk at all. A writer that omits the pad after a final odd-sized chunk, or that counts trailing bytes in the RIFF size, therefore lost its dimensions -- files golang.org/x/image reads without complaint. That is a silent downgrade on the base, calendar and doc-media paths and a hard failure on sheets +set-cell-image and docs remote images, which surface the decode error to the user. Separate the two bounds. The chunk payload must lie inside the container, which still rejects a chunk claiming to reach past it; the padding byte is only required where it is actually consumed, when skipping to the next chunk. Differential against x/image v0.30.0 over 300k mutated inputs: 168450 inputs accepted by both, zero dimension disagreements, and x/image-only acceptances down from 4806 to 3442. * test(imageconfig): reach the format readers when asserting error preservation TestMetadataPreservesReadCause injected its failure at offset 0, which Decode consumes for the magic bytes before it dispatches. readBMP and readWebP were never entered, so both could discard the source error and the test would still pass -- verified by mutation: making readBMP return errMetadata instead of the read error leaves the old assertion green. Inject at the first offset each reader requests on its own, and assert the reader ran by checking the format it reports. Raised by coderabbitai on internal/imageconfig/metadata_test.go. * test(deptest): pin the binary's external package surface Adding a module is visible: go.mod changes and the diff invites a look. Adding a subpackage of a module already required is not. The diff is one import line, go.mod is untouched, and the binary silently grows a new package graph. That is exactly how golang.org/x/net/idna entered this CLI -- via a single httpguts import added in #1910 for a header check that turned out to be redundant -- bringing three x/text packages with it. Nobody looked until an advisory landed on idna. The enumerated guard added alongside it only names the three packages already known to be a problem; it cannot see the next one. Record the non-stdlib package set of the release binary per GOOS and diff against it. Replaying the #1910 import against this guard reports the five packages it added, by name, on all three platforms. Regenerate with -update-import-surface after confirming an addition is intended. Also assert golang.org/x/image stays out of both the binary and the test graph, which is what this branch set out to remove and what nothing currently guards. * fix(deptest): read only stdout when recording the import surface The recorder used CombinedOutput, so "go: downloading ..." notices -- which go list writes to stderr -- were parsed as package names whenever the module cache was cold for the platform being listed. It passed here and failed on CI, which had never fetched the windows-only modules: go-winio, coninput, mousetrap and go-localereader showed up as four added packages. Read stdout only, keep stderr for the failure message, and fail loudly on any line containing whitespace, since an import path never does. Verified against a cold GOMODCACHE: the download notice lands on stderr and stdout stays clean. * fix(imageconfig): ignore the VP8X reserved fields, as the spec requires readWebP rejected a VP8X chunk whose reserved bits were non-zero: the two high flag bits, the low flag bit, or the 24-bit reserved block. The container spec says of each of them "MUST be 0. Readers MUST ignore this field." Writing a non-zero value is the writer's violation; refusing to read it is ours. Reproduced against a real cwebp VP8X file: with any one reserved bit set, golang.org/x/image reads 37x23 from both DecodeConfig and a full pixel decode, while this reader returned an error -- which surfaces to the user as a blocked docs image import or a failed sheets +set-cell-image. Keep the 10-byte chunk length and the container bounds, drop the reserved-field check. The malformed-metadata case that pinned the old behaviour now covers the chunk length instead. ---------