-
Notifications
You must be signed in to change notification settings - Fork 119
[+] Chusan events convert tool #143
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: v1-dev
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,57 @@ | ||||||||||
| import os | ||||||||||
| import sys | ||||||||||
| import xml.etree.ElementTree as ET | ||||||||||
|
|
||||||||||
|
|
||||||||||
| def extract_id_type(xml_file): | ||||||||||
| tree = ET.parse(xml_file) | ||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. security (opengrep-rules.python.lang.security.use-defused-xml-parse): 原生 Python
Suggested change
Source: opengrep Original comment in Englishsecurity (opengrep-rules.python.lang.security.use-defused-xml-parse): The native Python
Suggested change
Source: opengrep |
||||||||||
| root = tree.getroot() | ||||||||||
|
|
||||||||||
| # Extract id from /EventData/name/id | ||||||||||
| id_element = root.find(".//name/id") | ||||||||||
|
|
||||||||||
| if id_element is None: | ||||||||||
| print("Error: /EventData/name/id element not found") | ||||||||||
| return | ||||||||||
|
|
||||||||||
| id_value = int(id_element.text) | ||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. issue: 未检查 id/type 元素中是否存在非整数或缺失文本的情况。 如果 或 为空或包含非整数值,则会发生 ValueError。添加验证或异常处理以防止这种情况。 Original comment in Englishissue: No check for non-integer or missing text in id/type elements. If or are empty or contain non-integer values, a ValueError will occur. Add validation or exception handling to prevent this. |
||||||||||
|
|
||||||||||
| # Extract type from /EventData/substances/type | ||||||||||
| type_element = root.find(".//substances/type") | ||||||||||
|
|
||||||||||
| if type_element is None: | ||||||||||
| print("Error: /EventData/substances/type element not found") | ||||||||||
| return | ||||||||||
|
|
||||||||||
| type_value = int(type_element.text) | ||||||||||
|
|
||||||||||
| return (id_value, type_value) | ||||||||||
|
|
||||||||||
|
|
||||||||||
| if __name__ == "__main__": | ||||||||||
| lines = ["INSERT INTO chusan_game_event (id, type, end_date, start_date, enable)\nVALUES\n"] | ||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. issue (bug_risk): 生成的 SQL 语句始终以多余的逗号结尾。 如果没有添加任何行,则切掉最后两个字符可能会生成无效的 SQL 语句。请处理空的情况以避免格式错误的语句。 Original comment in Englishissue (bug_risk): The generated SQL will always end with an extra comma before the semicolon. If no rows are added, slicing off the last two characters may produce invalid SQL. Please handle the empty case to avoid malformed statements. |
||||||||||
|
|
||||||||||
| if len(sys.argv) < 2: | ||||||||||
| print("Usage: python chusan-events.py <dir_name>...") | ||||||||||
| exit(1) | ||||||||||
|
|
||||||||||
| for dir_name in sys.argv[1:]: | ||||||||||
| event_dir = os.path.join(dir_name, "event") | ||||||||||
|
|
||||||||||
| if not os.path.exists(event_dir): | ||||||||||
| continue | ||||||||||
|
|
||||||||||
| for sub_dir in os.listdir(event_dir): | ||||||||||
| sub_dir_path = os.path.join(event_dir, sub_dir) | ||||||||||
|
|
||||||||||
| if os.path.isdir(sub_dir_path): | ||||||||||
| xml_path = os.path.join(sub_dir_path, "Event.xml") | ||||||||||
|
|
||||||||||
| if os.path.exists(xml_path): | ||||||||||
| try: | ||||||||||
| id_value, type_value = extract_id_type(xml_path) | ||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. issue: 没有处理 extract_id_type 返回 None 的情况。 如果 extract_id_type 返回 None,则解包将失败并出现 TypeError。在解包之前添加对 None 的检查。 Original comment in Englishissue: No handling for extract_id_type returning None. Unpacking will fail with a TypeError if extract_id_type returns None. Add a check for None before unpacking. |
||||||||||
| lines.append(f" ({id_value},{type_value},'2029-01-01 00:00:00.000000','2019-01-01 00:00:00.000000',true),\n") | ||||||||||
| except Exception as e: | ||||||||||
| print(f"Error processing {xml_path}: {e}") | ||||||||||
|
|
||||||||||
| print("".join(lines)[:-2] + ";\n") | ||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
security (opengrep-rules.python.lang.security.use-defused-xml): Python 文档建议使用
defusedxml而不是xml,因为原生 Pythonxml库容易受到 XML 外部实体 (XXE) 攻击。这些攻击可能会泄露机密数据,“XML 炸弹”可能会导致拒绝服务。Source: opengrep
Original comment in English
security (opengrep-rules.python.lang.security.use-defused-xml): The Python documentation recommends using
defusedxmlinstead ofxmlbecause the native Pythonxmllibrary is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service.Source: opengrep