Conversation
…-MIAO and zh-TW JSON files, including translations for boolean values and improved clarity in descriptions.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Reviewer's Guide重构实时预览的后端和前端，以支持基于 scrcpy 和 ws-scrcpy 的低延迟 H264 流媒体（自适应画质和交互式设备控制），同时新增一个 CN 活动档期（20260625），并更新相关工具和元数据。 实时预览启动与推流时序图（ws_live_screenshot）sequenceDiagram
actor Browser
participant WebUI as WebUIServer
participant Scrcpy as LiveScrcpySession
participant WsScrcpy as LiveWsScrcpySession
participant FFmpeg as ffmpeg_screenshot_fallback
Browser->>WebUI: WebSocket /ws/live_screenshot(mode,fps,width,bitrate_scale)
WebUI->>WebUI: _ws_live_scrcpy(instance,fps,width,bitrate_scale)
alt ws-scrcpy available
WebUI->>WsScrcpy: LiveWsScrcpySession(instance,...)
WebUI->>WsScrcpy: start_server()
WebUI->>WsScrcpy: connect()
WsScrcpy-->>WebUI: recv() initial
WebUI->>WebUI: _ws_scrcpy_parse_initial(initial)
WebUI->>WsScrcpy: send_binary(_build_ws_scrcpy_video_settings(...))
WebUI->>WebUI: _collect_ws_scrcpy_preroll(session)
WebUI-->>Browser: ready (mode=ws-scrcpy, format=raw_h264)
loop video stream
WsScrcpy-->>WebUI: recv()
WebUI-->>Browser: send_bytes(data)
end
else ws-scrcpy failed
WebUI->>Scrcpy: LiveScrcpySession.acquire(instance,fps,width,bitrate_scale)
WebUI->>WebUI: _collect_h264_preroll(session,stop_event)
WebUI-->>Browser: ready (mode=scrcpy, format=raw_h264)
WebUI-->>Browser: send_bytes(preroll)
loop raw H264
Scrcpy-->>WebUI: read_video()
WebUI-->>Browser: send_bytes(raw_h264)
end
else scrcpy unavailable or mode=screenshot
WebUI->>FFmpeg: _ws_live_screenshot_fallback(...)
WebUI-->>Browser: ready (mode=screenshot, mime=video/mp4)
loop screenshots
FFmpeg-->>WebUI: out_queue (data)
WebUI-->>Browser: send_bytes(chunk)
end
end
交互式设备控制时序图（ws_live_control）sequenceDiagram
actor Browser
participant WebUI as WebUIServer
participant WsScrcpy as LiveWsScrcpySession
participant Scrcpy as LiveScrcpySession
participant ADB as LiveControlDevice
Browser->>WebUI: WebSocket /ws/live_control?instance=...
WebUI->>WebUI: get_target()
alt ws-scrcpy session exists
WebUI->>WsScrcpy: LiveWsScrcpySession.get(instance)
else scrcpy session exists
WebUI->>Scrcpy: LiveScrcpySession.get(instance)
else fallback
WebUI->>ADB: LiveControlDevice(instance)
end
loop control messages
Browser-->>WebUI: receive_text() (JSON)
WebUI->>WebUI: json.loads(raw)
alt type=tap
WebUI->>target: tap(x,y)
else type=drag
WebUI->>target: drag(start,end,duration_ms)
else type=key
WebUI->>WebUI: _key_to_android_keycode(key)
WebUI->>target: keycode(keycode)
else type=text
WebUI->>target: text(text)
else system actions (back,home,app_switch)
WebUI->>target: keycode(CONTROL_ACTION_KEYCODES[action])
else unknown
WebUI-->>Browser: send_text({type:error,...})
end
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your Experience进入你的 dashboard 以：
Getting HelpOriginal review guide in EnglishReviewer's GuideRefactors the live preview backend and frontend to support scrcpy- and ws-scrcpy-based low-latency H264 streaming with adaptive quality and interactive device control, while adding a new CN event campaign (20260625) and updating associated tooling and metadata. Sequence diagram for live preview startup and streaming (ws_live_screenshot)sequenceDiagram
actor Browser
participant WebUI as WebUIServer
participant Scrcpy as LiveScrcpySession
participant WsScrcpy as LiveWsScrcpySession
participant FFmpeg as ffmpeg_screenshot_fallback
Browser->>WebUI: WebSocket /ws/live_screenshot(mode,fps,width,bitrate_scale)
WebUI->>WebUI: _ws_live_scrcpy(instance,fps,width,bitrate_scale)
alt ws-scrcpy available
WebUI->>WsScrcpy: LiveWsScrcpySession(instance,...)
WebUI->>WsScrcpy: start_server()
WebUI->>WsScrcpy: connect()
WsScrcpy-->>WebUI: recv() initial
WebUI->>WebUI: _ws_scrcpy_parse_initial(initial)
WebUI->>WsScrcpy: send_binary(_build_ws_scrcpy_video_settings(...))
WebUI->>WebUI: _collect_ws_scrcpy_preroll(session)
WebUI-->>Browser: ready (mode=ws-scrcpy, format=raw_h264)
loop video stream
WsScrcpy-->>WebUI: recv()
WebUI-->>Browser: send_bytes(data)
end
else ws-scrcpy failed
WebUI->>Scrcpy: LiveScrcpySession.acquire(instance,fps,width,bitrate_scale)
WebUI->>WebUI: _collect_h264_preroll(session,stop_event)
WebUI-->>Browser: ready (mode=scrcpy, format=raw_h264)
WebUI-->>Browser: send_bytes(preroll)
loop raw H264
Scrcpy-->>WebUI: read_video()
WebUI-->>Browser: send_bytes(raw_h264)
end
else scrcpy unavailable or mode=screenshot
WebUI->>FFmpeg: _ws_live_screenshot_fallback(...)
WebUI-->>Browser: ready (mode=screenshot, mime=video/mp4)
loop screenshots
FFmpeg-->>WebUI: out_queue (data)
WebUI-->>Browser: send_bytes(chunk)
end
end
Sequence diagram for interactive device control (ws_live_control)sequenceDiagram
actor Browser
participant WebUI as WebUIServer
participant WsScrcpy as LiveWsScrcpySession
participant Scrcpy as LiveScrcpySession
participant ADB as LiveControlDevice
Browser->>WebUI: WebSocket /ws/live_control?instance=...
WebUI->>WebUI: get_target()
alt ws-scrcpy session exists
WebUI->>WsScrcpy: LiveWsScrcpySession.get(instance)
else scrcpy session exists
WebUI->>Scrcpy: LiveScrcpySession.get(instance)
else fallback
WebUI->>ADB: LiveControlDevice(instance)
end
loop control messages
Browser-->>WebUI: receive_text() (JSON)
WebUI->>WebUI: json.loads(raw)
alt type=tap
WebUI->>target: tap(x,y)
else type=drag
WebUI->>target: drag(start,end,duration_ms)
else type=key
WebUI->>WebUI: _key_to_android_keycode(key)
WebUI->>target: keycode(keycode)
else type=text
WebUI->>target: text(text)
else system actions (back,home,app_switch)
WebUI->>target: keycode(CONTROL_ACTION_KEYCODES[action])
else unknown
WebUI-->>Browser: send_text({type:error,...})
end
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - 我发现了 4 个安全问题，并给出了一些总体反馈：
安全问题：
- 在
innerHTML、outerHTML或document.write等方法中使用用户可控数据是一种反模式，可能导致 XSS 漏洞（链接） - 在
panel.innerHTML中使用用户可控数据是一种反模式，可能导致 XSS 漏洞（链接） - 检测到不安全的 WebSocket。所有 WebSocket 连接都应该使用安全 WebSocket (wss)。（链接）
- 检测到使用
Popen的子进程调用且未使用静态字符串。如果这些数据可能被恶意行为者控制，则可能存在命令注入风险。请审计该调用以确保它不能被外部资源控制。你可以考虑使用shlex.escape()。（链接）
一般性评论：
LiveScrcpySession._scrcpy_command在调用command_v120之前，会临时修改全局ScrcpyOptions.frame_rate。建议考虑通过参数传递 FPS 或克隆选项，而不是修改共享的全局状态，以避免在其他代码并发构建 scrcpy 命令时出现意料之外的副作用。LiveWsScrcpySession和LiveScrcpySession都实现了类似的坐标缩放逻辑（_scale_point/scale_point）以及触摸/拖拽/按键/文本等控制流程；建议抽取用于指针缩放和控制消息构造的共享辅助函数，以减少重复，并帮助在不同模式下保持行为一致。_video_stream_params目前接收一个codec参数，但并未根据它进行分支逻辑，同时ws_live_screenshot强制使用codec="h264"；建议要么移除未使用的codec参数和前端的编解码器设置，要么实现所需的编解码器特定行为，以保持 API 设计的一致性。
供 AI 代理使用的提示词
请根据以下代码评审意见进行修改：
## 总体评论
- `LiveScrcpySession._scrcpy_command` 在调用 `command_v120` 之前，会临时修改全局 `ScrcpyOptions.frame_rate`。建议考虑通过参数传递 FPS 或克隆选项，而不是修改共享的全局状态，以避免在其他代码并发构建 scrcpy 命令时出现意料之外的副作用。
- `LiveWsScrcpySession` 和 `LiveScrcpySession` 都实现了类似的坐标缩放逻辑（`_scale_point`/`scale_point`）以及触摸/拖拽/按键/文本等控制流程；建议抽取用于指针缩放和控制消息构造的共享辅助函数，以减少重复，并帮助在不同模式下保持行为一致。
- `_video_stream_params` 目前接收一个 `codec` 参数，但并未根据它进行分支逻辑，同时 `ws_live_screenshot` 强制使用 `codec="h264"`；建议要么移除未使用的 `codec` 参数和前端的编解码器设置，要么实现所需的编解码器特定行为，以保持 API 设计的一致性。
## 单独评论
### 评论 1
<location path="assets/gui/js/alas-utils.js" line_range="231-245" />
<code_context>
panel.innerHTML = [
'<div class="alas-live-preview-head">',
'<span class="alas-live-preview-title">实时截图</span>',
'<button class="alas-live-preview-control" type="button" data-live-control="back" title="返回">↩</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="home" title="主页">⌂</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="app_switch" title="后台">▣</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="keyboard" title="手机键盘">⌨</button>',
'<button class="alas-live-preview-fullscreen" type="button" title="全屏控制">⛶</button>',
'<button class="alas-live-preview-close" type="button" title="关闭">×</button>',
'</div>',
'<video class="alas-live-preview-video" muted autoplay playsinline></video>',
'<canvas class="alas-live-preview-canvas"></canvas>',
'<textarea class="alas-live-preview-keyboard-input" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"></textarea>',
'<div class="alas-live-preview-status">连接中</div>'
].join('');
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** 在 `innerHTML`、`outerHTML` 或 `document.write` 等方法中使用用户可控数据是一种反模式，可能导致 XSS 漏洞。
*Source: opengrep*
</issue_to_address>
### 评论 2
<location path="assets/gui/js/alas-utils.js" line_range="231-245" />
<code_context>
panel.innerHTML = [
'<div class="alas-live-preview-head">',
'<span class="alas-live-preview-title">实时截图</span>',
'<button class="alas-live-preview-control" type="button" data-live-control="back" title="返回">↩</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="home" title="主页">⌂</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="app_switch" title="后台">▣</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="keyboard" title="手机键盘">⌨</button>',
'<button class="alas-live-preview-fullscreen" type="button" title="全屏控制">⛶</button>',
'<button class="alas-live-preview-close" type="button" title="关闭">×</button>',
'</div>',
'<video class="alas-live-preview-video" muted autoplay playsinline></video>',
'<canvas class="alas-live-preview-canvas"></canvas>',
'<textarea class="alas-live-preview-keyboard-input" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"></textarea>',
'<div class="alas-live-preview-status">连接中</div>'
].join('');
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** 在 `panel.innerHTML` 中使用用户可控数据是一种反模式，可能导致 XSS 漏洞。
*Source: opengrep*
</issue_to_address>
### 评论 3
<location path="assets/gui/js/alas-utils.js" line_range="761" />
<code_context>
var scheme = location.protocol === 'https:' ? 'wss://' : 'ws://';
</code_context>
<issue_to_address>
**security (javascript.lang.security.detect-insecure-websocket):** 检测到不安全的 WebSocket。所有 WebSocket 连接都应该使用安全 WebSocket (wss)。
*Source: opengrep*
</issue_to_address>
### 评论 4
<location path="module/webui/api.py" line_range="1165-1169" />
<code_context>
proc = subprocess.Popen(
_video_stream_command(ffmpeg, codec, target_width, target_height, fps, stream_params),
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
bufsize=0,
)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** 检测到使用子进程函数 `Popen` 且未使用静态字符串。如果这些数据可能被恶意行为者控制，则可能存在命令注入风险。请审计该调用以确保它不能被外部资源控制。你可以考虑使用 `shlex.escape()`。
*Source: opengrep*
</issue_to_address>帮我变得更有用！请对每个评论点 👍 或 👎，我会根据你的反馈改进后续评审。
Original comment in English
Hey - I've found 4 security issues, and left some high level feedback:
Security issues:
- User controlled data in methods like
innerHTML,outerHTMLordocument.writeis an anti-pattern that can lead to XSS vulnerabilities (link) - User controlled data in a
panel.innerHTMLis an anti-pattern that can lead to XSS vulnerabilities (link) - Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. (link)
- Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
General comments:
- LiveScrcpySession._scrcpy_command temporarily mutates the global ScrcpyOptions.frame_rate before calling command_v120; consider passing the FPS via arguments or cloning options instead of changing a shared global to avoid surprising side effects if other code builds scrcpy commands concurrently.
- LiveWsScrcpySession and LiveScrcpySession both implement similar coordinate scaling logic (_scale_point/scale_point) and touch/drag/key/text control flows; extracting shared helpers for pointer scaling and control message construction would reduce duplication and help keep behavior consistent across modes.
- _video_stream_params currently accepts a codec parameter but does not branch on it and ws_live_screenshot forces codec="h264"; either remove the unused codec parameter and front-end codec setting or implement the required codec-specific behavior to keep the API surface coherent.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- LiveScrcpySession._scrcpy_command temporarily mutates the global ScrcpyOptions.frame_rate before calling command_v120; consider passing the FPS via arguments or cloning options instead of changing a shared global to avoid surprising side effects if other code builds scrcpy commands concurrently.
- LiveWsScrcpySession and LiveScrcpySession both implement similar coordinate scaling logic (_scale_point/scale_point) and touch/drag/key/text control flows; extracting shared helpers for pointer scaling and control message construction would reduce duplication and help keep behavior consistent across modes.
- _video_stream_params currently accepts a codec parameter but does not branch on it and ws_live_screenshot forces codec="h264"; either remove the unused codec parameter and front-end codec setting or implement the required codec-specific behavior to keep the API surface coherent.
## Individual Comments
### Comment 1
<location path="assets/gui/js/alas-utils.js" line_range="231-245" />
<code_context>
panel.innerHTML = [
'<div class="alas-live-preview-head">',
'<span class="alas-live-preview-title">实时截图</span>',
'<button class="alas-live-preview-control" type="button" data-live-control="back" title="返回">↩</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="home" title="主页">⌂</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="app_switch" title="后台">▣</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="keyboard" title="手机键盘">⌨</button>',
'<button class="alas-live-preview-fullscreen" type="button" title="全屏控制">⛶</button>',
'<button class="alas-live-preview-close" type="button" title="关闭">×</button>',
'</div>',
'<video class="alas-live-preview-video" muted autoplay playsinline></video>',
'<canvas class="alas-live-preview-canvas"></canvas>',
'<textarea class="alas-live-preview-keyboard-input" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"></textarea>',
'<div class="alas-live-preview-status">连接中</div>'
].join('');
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 2
<location path="assets/gui/js/alas-utils.js" line_range="231-245" />
<code_context>
panel.innerHTML = [
'<div class="alas-live-preview-head">',
'<span class="alas-live-preview-title">实时截图</span>',
'<button class="alas-live-preview-control" type="button" data-live-control="back" title="返回">↩</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="home" title="主页">⌂</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="app_switch" title="后台">▣</button>',
'<button class="alas-live-preview-control" type="button" data-live-control="keyboard" title="手机键盘">⌨</button>',
'<button class="alas-live-preview-fullscreen" type="button" title="全屏控制">⛶</button>',
'<button class="alas-live-preview-close" type="button" title="关闭">×</button>',
'</div>',
'<video class="alas-live-preview-video" muted autoplay playsinline></video>',
'<canvas class="alas-live-preview-canvas"></canvas>',
'<textarea class="alas-live-preview-keyboard-input" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"></textarea>',
'<div class="alas-live-preview-status">连接中</div>'
].join('');
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 3
<location path="assets/gui/js/alas-utils.js" line_range="761" />
<code_context>
var scheme = location.protocol === 'https:' ? 'wss://' : 'ws://';
</code_context>
<issue_to_address>
**security (javascript.lang.security.detect-insecure-websocket):** Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
*Source: opengrep*
</issue_to_address>
### Comment 4
<location path="module/webui/api.py" line_range="1165-1169" />
<code_context>
proc = subprocess.Popen(
_video_stream_command(ffmpeg, codec, target_width, target_height, fps, stream_params),
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
bufsize=0,
)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
231
to
245
| panel.innerHTML = [ | ||
| '<div class="alas-live-preview-head">', | ||
| '<span class="alas-live-preview-title">实时截图</span>', | ||
| '<select class="alas-live-preview-codec" title="编码">', | ||
| '<option value="h264">H264</option>', | ||
| '<option value="h265">H265</option>', | ||
| '</select>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="back" title="返回">↩</button>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="home" title="主页">⌂</button>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="app_switch" title="后台">▣</button>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="keyboard" title="手机键盘">⌨</button>', | ||
| '<button class="alas-live-preview-fullscreen" type="button" title="全屏控制">⛶</button>', | ||
| '<button class="alas-live-preview-close" type="button" title="关闭">×</button>', | ||
| '</div>', | ||
| '<video class="alas-live-preview-video" muted autoplay playsinline></video>', | ||
| '<canvas class="alas-live-preview-canvas"></canvas>', | ||
| '<textarea class="alas-live-preview-keyboard-input" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"></textarea>', | ||
| '<div class="alas-live-preview-status">连接中</div>' | ||
| ].join(''); |
There was a problem hiding this comment.
security (javascript.browser.security.insecure-document-method): 在 innerHTML、outerHTML 或 document.write 等方法中使用用户可控数据是一种反模式，可能导致 XSS 漏洞。
Source: opengrep
Original comment in English
security (javascript.browser.security.insecure-document-method): User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities
Source: opengrep
Comment on lines
231
to
245
| panel.innerHTML = [ | ||
| '<div class="alas-live-preview-head">', | ||
| '<span class="alas-live-preview-title">实时截图</span>', | ||
| '<select class="alas-live-preview-codec" title="编码">', | ||
| '<option value="h264">H264</option>', | ||
| '<option value="h265">H265</option>', | ||
| '</select>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="back" title="返回">↩</button>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="home" title="主页">⌂</button>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="app_switch" title="后台">▣</button>', | ||
| '<button class="alas-live-preview-control" type="button" data-live-control="keyboard" title="手机键盘">⌨</button>', | ||
| '<button class="alas-live-preview-fullscreen" type="button" title="全屏控制">⛶</button>', | ||
| '<button class="alas-live-preview-close" type="button" title="关闭">×</button>', | ||
| '</div>', | ||
| '<video class="alas-live-preview-video" muted autoplay playsinline></video>', | ||
| '<canvas class="alas-live-preview-canvas"></canvas>', | ||
| '<textarea class="alas-live-preview-keyboard-input" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"></textarea>', | ||
| '<div class="alas-live-preview-status">连接中</div>' | ||
| ].join(''); |
There was a problem hiding this comment.
security (javascript.browser.security.insecure-innerhtml): 在 panel.innerHTML 中使用用户可控数据是一种反模式，可能导致 XSS 漏洞。
Source: opengrep
Original comment in English
security (javascript.browser.security.insecure-innerhtml): User controlled data in a panel.innerHTML is an anti-pattern that can lead to XSS vulnerabilities
Source: opengrep
| @@ -334,7 +760,11 @@ | |||
| function getSocketCandidates() { | |||
| var scheme = location.protocol === 'https:' ? 'wss://' : 'ws://'; | |||
There was a problem hiding this comment.
security (javascript.lang.security.detect-insecure-websocket): 检测到不安全的 WebSocket。所有 WebSocket 连接都应该使用安全 WebSocket (wss)。
Source: opengrep
Original comment in English
security (javascript.lang.security.detect-insecure-websocket): Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
Source: opengrep
Comment on lines
1165
to
1169
| proc = subprocess.Popen( | ||
| _video_stream_command(ffmpeg, codec, target_width, target_height, fps), | ||
| _video_stream_command(ffmpeg, codec, target_width, target_height, fps, stream_params), | ||
| stdin=subprocess.PIPE, | ||
| stdout=subprocess.PIPE, | ||
| stderr=subprocess.PIPE, |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): 检测到使用子进程函数 Popen 且未使用静态字符串。如果这些数据可能被恶意行为者控制，则可能存在命令注入风险。请审计该调用以确保它不能被外部资源控制。你可以考虑使用 shlex.escape()。
Source: opengrep
Original comment in English
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces a real-time video preview feature using H264 over WebSockets (via scrcpy/ws-scrcpy) with canvas rendering, fullscreen control, and mobile keyboard support. It also adds map scripts and configurations for the new event "美梦巡演：奇妙夜" (event_20260625_cn), alongside various localization updates and terminology standardizations across English, Japanese, and Chinese translation files. The review feedback highlights localization issues where the new event name was left in Simplified Chinese in the English, Japanese, and Traditional Chinese translation files, and points out a quotation mark typo in the Traditional Chinese translation.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "event_20260326_cn": "The Vagabond’s Recruitment Plan", | ||
| "event_20260417_cn": "Vacation Lane – Beachside Brilliance", | ||
| "event_20260520_cn": "Alliance Before the Hagiobull", | ||
| "event_20260625_cn": "美梦巡演：奇妙夜", |
Contributor
There was a problem hiding this comment.
The new event name is in Chinese in the English localization file. Please translate "美梦巡演：奇妙夜" to English.
| "event_20260326_cn": "ワンダラー募集計画", | ||
| "event_20260417_cn": "バケーションレーン・きらめく砂浜", | ||
| "event_20260520_cn": "聖印前の同盟", | ||
| "event_20260625_cn": "美梦巡演：奇妙夜", |
Contributor
There was a problem hiding this comment.
The new event name is in Chinese in the Japanese localization file. Please translate "美梦巡演：奇妙夜" to Japanese.
| "event_20260326_cn": "漫遊者招募計劃", | ||
| "event_20260417_cn": "假日航線閃耀海濱", | ||
| "event_20260520_cn": "聖印前的同盟", | ||
| "event_20260625_cn": "美梦巡演：奇妙夜", |
Contributor
There was a problem hiding this comment.
The event name "美梦巡演：奇妙夜" is in Simplified Chinese. In this Traditional Chinese localization file, it should be converted to "美夢巡演：奇妙夜".
Suggested change
| "event_20260625_cn": "美梦巡演：奇妙夜", | |
| "event_20260625_cn": "美夢巡演：奇妙夜", |
| "help": "需要同時開啟「推送大世界相關資訊」功能。\n關閉時使用智慧港區設定 —> 調試設定 —> 錯誤推送設定，需要同時開啟「錯誤推送」功能。\n開啟時使用大世界推送設定，需要分離推送內容時請開啟此功能" | ||
| }, | ||
| "OpsiOnePushConfig": { | ||
| "name": "大世界推送設定", |
Contributor
There was a problem hiding this comment.
There appears to be a typo with the opening quotation mark. A closing quotation mark ” is used instead of an opening one. For consistency with Taiwanese punctuation, it's better to use 「 and 」.
"help": "「大世界資訊獨立推送」功能開啟時設定才生效。使用 Onepush 推送一條關於侵蝕1和短貓的資訊。配置方法見文檔：https://github.com/LmeSzinc/AzurLaneAutoScript/wiki/Onepush-configuration-%5BCN%5D"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
使用基于 scrcpy 的低延迟直播预览与控制（通过 WebSocket），并新增国服活动关卡地图。
New Features:
scrcpy和ws-scrcpy的实时预览管线，采用原始 H264 传输，并在需要时自动回退到基于ffmpeg的截图流。event_20260625_cn添加活动配置和地图脚本，覆盖 T/HT/SP 等关卡。Bug Fixes:
Enhancements:
Original summary in English
Summary by Sourcery
Implement scrcpy-based low-latency live preview and control over WebSocket and add new CN event campaign maps.
New Features:
event_20260625_cn, including T/HT/SP stages.Bug Fixes:
Enhancements: