fix(kya_lib): remove broken SIG_RE.pattern fallback in unlock_wallet#2
Open
fadai216 wants to merge 1 commit into
Open
fix(kya_lib): remove broken SIG_RE.pattern fallback in unlock_wallet#2fadai216 wants to merge 1 commit into
fadai216 wants to merge 1 commit into
Conversation
The existing fallback on JSONDecodeError was:
token = out if SIG_RE.pattern and out else ""
SIG_RE.pattern is the compiled regex pattern *string*
("^0x[a-fA-F0-9]{130}$") which is always truthy, so this
effectively accepted ANY non-empty stdout as a session token,
defeating the validation the check was meant to perform.
Since current awp-wallet versions always emit JSON on unlock,
the legacy text fallback is dead code. Replace it with an
empty-string sentinel so the existing if not token: die(...)
check triggers cleanly instead of silently admitting garbage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
unlock_wallet()inscripts/kya_lib.pyhas a broken validation check on the JSON-decode fallback path:SIG_RE.patternis the pattern string of the compiled regex ("^0x[a-fA-F0-9]{130}$"), so it is always truthy. The expression reduces totoken = out if out else "", meaning the fallback path accepts any non-empty stdout as a session token — defeating the validation it was meant to provide. A malformedawp-wallet unlockoutput would become a fake token that flows throughos.environ["AWP_WALLET_TOKEN"]into every subsequent command.Fix
Current
awp-wallet(≥ 0.17.0 per SKILL.md) always emits JSON on unlock, so the legacy text fallback is dead code. Replace it with an empty-string sentinel so the existingcheck triggers cleanly, instead of silently admitting garbage.
Diff
try: token = json.loads(out).get("token", "") except json.JSONDecodeError: - # 一些老版本支持 `unlock --raw` 直接打印 token；兼容一下 - token = out if SIG_RE.pattern and out else "" + # awp-wallet emits JSON-only now; no legacy text fallback + token = ""No behaviour change for the common path (successful JSON parse). Only tightens the malformed-output path, which would have previously leaked invalid data forward.