Conversation
jcy321
commented
Mar 10, 2026
jcy321
commented
- 新增 availability 模块用于测试 API 模型可用性
- 添加 Python 测试脚本检测模型能力（思考/多模态）
- 添加可视化 HTML 报告页面
- 添加 Go 路由支持 /availability 访问
- 支持定时任务运行检测
- 新增 availability 模块用于测试 API 模型可用性 - 添加 Python 测试脚本检测模型能力（思考/多模态） - 添加可视化 HTML 报告页面 - 添加 Go 路由支持 /availability 访问 - 支持定时任务运行检测
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 此拉取请求引入了一个全面的模型可用性监控系统。它通过自动化测试脚本定期评估 API 模型的运行状态和特定功能（如思考和多模态），并将结果以用户友好的可视化报告形式呈现。这大大提升了对模型服务质量的洞察力，并能及时发现潜在问题，确保服务的稳定性和可靠性。 Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This PR introduces a very useful model availability detection module, including a Python detection script, a frontend report page, and a Go backend route. The overall implementation is good, with clear code structure and complete functionality. However, several security vulnerabilities were identified, including path traversal in the file serving controller, missing access control on the availability routes, and potential cross-site scripting (XSS) in the report visualization page. These critical issues must be addressed before merging. Additionally, there are areas for improvement: using a bare except: in availability/test_models.py is bad practice and should be replaced with more specific exception handling, and the copy-to-clipboard function in availability/index.html fails in HTTP environments, which contradicts the documentation's HTTP examples.
| relativePath := c.Param("path") // 获取请求的相对路径 | ||
|
|
||
| // --- 处理默认路径 --- | ||
| if relativePath == "" || relativePath == "/" { | ||
| relativePath = "/index.html" // 默认返回首页 | ||
| } | ||
|
|
||
| relativePath = strings.TrimPrefix(relativePath, "/") // 移除前导斜杠 | ||
| filePath := filepath.Join(availabilityDir, relativePath) // 拼接完整文件路径 |
There was a problem hiding this comment.
The ServeAvailability function is vulnerable to path traversal. It uses a user-supplied path parameter to construct a file path without proper sanitization. Attackers can exploit this by including ../ sequences in the path parameter (e.g., /availability/../main.go), allowing them to traverse directories and read arbitrary files on the server outside the availability directory. filepath.Join resolves .., which contributes to this vulnerability. Additionally, the current manual implementation of static file serving introduces code redundancy. To address the path traversal, filepath.Clean should be used to sanitize the path parameter as shown in the suggestion, preventing directory traversal.
relativePath := c.Param("path")
// --- 处理默认路径 ---
if relativePath == "" || relativePath == "/" {
relativePath = "/index.html"
}
relativePath = strings.TrimPrefix(relativePath, "/")
// Use filepath.Clean to prevent path traversal
cleanPath := filepath.Clean(relativePath)
if strings.HasPrefix(cleanPath, "..") || filepath.IsAbs(cleanPath) {
c.Status(http.StatusBadRequest)
return
}
filePath := filepath.Join(availabilityDir, cleanPath)| availabilityRouter := router.Group("/availability") // 可用性报告路径前缀 | ||
| availabilityRouter.Use(middleware.RouteTag("availability")) // 标记路由类型 | ||
| availabilityRouter.Use(gzip.Gzip(gzip.DefaultCompression)) // 启用gzip压缩 | ||
| { | ||
| availabilityRouter.GET("/*path", controller.ServeAvailability) // 所有子路径由控制器处理 | ||
| } |
There was a problem hiding this comment.
The /availability route group lacks any authentication or authorization checks. This allows unauthenticated users to access the availability report and, combined with the path traversal vulnerability, read arbitrary files on the server.
func SetAvailabilityRouter(router *gin.Engine) {
availabilityRouter := router.Group("/availability")
availabilityRouter.Use(middleware.RouteTag("availability"))
availabilityRouter.Use(middleware.UserAuth())
availabilityRouter.Use(middleware.AdminAuth())
availabilityRouter.Use(gzip.Gzip(gzip.DefaultCompression))
{
availabilityRouter.GET("/*path", controller.ServeAvailability)
}
}| document.getElementById('modelGrid').innerHTML = filtered.map(m => { | ||
| const timeClass = m.responseTime < 1 ? 'fast' : m.responseTime < 5 ? 'medium' : 'slow'; // 响应时间分类 | ||
| return ` | ||
| <div class="model-card" onclick="copyModel('${m.model}')"> | ||
| <div class="model-card-name">${m.model}</div> | ||
| <div class="model-tags"> | ||
| ${m.isThinking ? '<span class="tag thinking">Thinking</span>' : ''} <!-- 思考模型标签 --> | ||
| ${m.supportsVision ? '<span class="tag vision">Vision</span>' : ''} <!-- 多模态标签 --> | ||
| ${!m.available ? '<span class="tag unavailable">Unavailable</span>' : ''} | ||
| </div> | ||
| <div class="model-meta"> | ||
| <span>${m.available ? '✅ OK' : '❌ ' + (m.error || 'N/A')}</span> | ||
| ${m.responseTime ? `<span class="${timeClass}">⚡ ${m.responseTime.toFixed(1)}s</span>` : ''} <!-- 响应时间 --> | ||
| </div> | ||
| </div> | ||
| `; | ||
| }).join(''); |
There was a problem hiding this comment.
The availability/index.html file fetches data from results.json and renders it using innerHTML without proper escaping. Specifically, the model and error fields from the JSON data are directly embedded into the HTML. If an attacker can control the model names or trigger specific error messages (e.g., through a malicious API response), they can inject and execute arbitrary JavaScript in the context of the user's browser.
| document.getElementById('modelGrid').innerHTML = filtered.map(m => { | |
| const timeClass = m.responseTime < 1 ? 'fast' : m.responseTime < 5 ? 'medium' : 'slow'; // 响应时间分类 | |
| return ` | |
| <div class="model-card" onclick="copyModel('${m.model}')"> | |
| <div class="model-card-name">${m.model}</div> | |
| <div class="model-tags"> | |
| ${m.isThinking ? '<span class="tag thinking">Thinking</span>' : ''} <!-- 思考模型标签 --> | |
| ${m.supportsVision ? '<span class="tag vision">Vision</span>' : ''} <!-- 多模态标签 --> | |
| ${!m.available ? '<span class="tag unavailable">Unavailable</span>' : ''} | |
| </div> | |
| <div class="model-meta"> | |
| <span>${m.available ? '✅ OK' : '❌ ' + (m.error || 'N/A')}</span> | |
| ${m.responseTime ? `<span class="${timeClass}">⚡ ${m.responseTime.toFixed(1)}s</span>` : ''} <!-- 响应时间 --> | |
| </div> | |
| </div> | |
| `; | |
| }).join(''); | |
| document.getElementById('modelGrid').innerHTML = filtered.map(m => { | |
| const timeClass = m.responseTime < 1 ? 'fast' : m.responseTime < 5 ? 'medium' : 'slow'; | |
| const safeModel = document.createElement('div').appendChild(document.createTextNode(m.model)).parentNode.innerHTML; | |
| const safeError = document.createElement('div').appendChild(document.createTextNode(m.error || 'N/A')).parentNode.innerHTML; | |
| return ` | |
| <div class="model-card" onclick="copyModel('${safeModel}')"> | |
| <div class="model-card-name">${safeModel}</div> | |
| <div class="model-tags"> | |
| ${m.isThinking ? '<span class="tag thinking">Thinking</span>' : ''} | |
| ${m.supportsVision ? '<span class="tag vision">Vision</span>' : ''} | |
| ${!m.available ? '<span class="tag unavailable">Unavailable</span>' : ''} | |
| </div> | |
| <div class="model-meta"> | |
| <span>${m.available ? '✅ OK' : '❌ ' + safeError}</span> | |
| ${m.responseTime ? `<span class="${timeClass}">⚡ ${m.responseTime.toFixed(1)}s</span>` : ''} | |
| </div> | |
| </div> | |
| `; | |
| }).join(''); |
| try: | ||
| response = requests.post(f"{baseUrl}/chat/completions", headers=headers, json=payload, timeout=timeout) | ||
| if response.status_code == 200: | ||
| data = response.json() | ||
| return bool(data.get("choices", [{}])[0].get("message", {}).get("content")) # 有返回内容则支持视觉 | ||
| except: | ||
| pass |
There was a problem hiding this comment.
避免使用裸露的 except:
在 testVision 函数中，except: 会捕获所有类型的异常，包括 KeyboardInterrupt 和 SystemExit，这通常不是期望的行为。这种做法会隐藏潜在的 bug，使调试变得困难。
建议至少捕获 Exception，或者更具体的异常，例如 requests.exceptions.RequestException。同时，最好记录下发生的错误，以便排查问题。
| try: | |
| response = requests.post(f"{baseUrl}/chat/completions", headers=headers, json=payload, timeout=timeout) | |
| if response.status_code == 200: | |
| data = response.json() | |
| return bool(data.get("choices", [{}])[0].get("message", {}).get("content")) # 有返回内容则支持视觉 | |
| except: | |
| pass | |
| try: | |
| response = requests.post(f"{baseUrl}/chat/completions", headers=headers, json=payload, timeout=timeout) | |
| if response.status_code == 200: | |
| data = response.json() | |
| return bool(data.get("choices", [{}])[0].get("message", {}).get("content")) | |
| except requests.exceptions.RequestException as e: | |
| print(f" [视觉测试请求失败]: {e}") | |
| except Exception as e: | |
| print(f" [视觉测试出现意外错误]: {e}") |
| } | ||
|
|
||
| function copyModel(name) { | ||
| navigator.clipboard.writeText(name).then(() => { |
There was a problem hiding this comment.
剪贴板功能需要安全上下文 (HTTPS)
navigator.clipboard.writeText() API 为了安全起见，在大多数现代浏览器中只在安全上下文（即 HTTPS 页面或 localhost）下可用。
当前 README.md 中的访问示例是 http://。如果服务部署在非本地的 HTTP 环境下，“点击复制”功能将无法工作，并且可能不会有明显的错误提示。
建议：
- 在
README.md中强调建议使用 HTTPS 部署。 - 可以在 JavaScript 代码中增加一个检查，如果
navigator.clipboard不可用，可以给用户一个提示，或者优雅地禁用复制功能，以改善用户体验。例如，在copyModel函数中添加一个if (!navigator.clipboard)的判断。
1 participant
