Repository navigation
Conversation
wcqqq1214
marked this pull request as ready for review
October 26, 2026 17:45
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="tests/test_backup.py" line_range="632-713" />
<code_context>
+ async def test_attachment_write_failure_marks_restore_failed(
</code_context>
<issue_to_address>
**New backup tests are added**
The change adds new test cases to the existing test file, contrary to the instruction not to generate test files.
Remove the newly added test cases from this change.
Also at `tests/test_backup.py:1162-1218`.
</issue_to_address>Sourcery assessment
Needs a human reviewer. Restoring an attachment can overwrite a file in the target attachments directory and persist a rebased path in the database; if either is wrong, reverting the code does not restore the previous bytes or path. The path checks limit where files can be written, but they do not make an incorrect restore reversible.
Comment on lines
+632
to
+713
| async def test_attachment_write_failure_marks_restore_failed( | ||
| self, mock_main_db, tmp_path | ||
| ): | ||
| """Report attachment write failures through the overall import result. | ||
|
|
||
| Args: | ||
| mock_main_db: Database double for the unrelated table import. | ||
| tmp_path: Temporary directory for the archive and restore target. | ||
| """ | ||
| attachment_dir = tmp_path / "attachments" | ||
| (attachment_dir / "test-id.txt").mkdir(parents=True) | ||
| archive = tmp_path / "backup.zip" | ||
| with zipfile.ZipFile(archive, "w") as zf: | ||
| zf.writestr("manifest.json", json.dumps({"astrbot_version": VERSION})) | ||
| zf.writestr( | ||
| "databases/main_db.json", | ||
| json.dumps( | ||
| { | ||
| "attachments": [ | ||
| { | ||
| "attachment_id": "test-id", | ||
| "path": "/old-install/data/attachments/uploaded.txt", | ||
| } | ||
| ] | ||
| } | ||
| ), | ||
| ) | ||
| zf.writestr("files/attachments/test-id.txt", "payload") | ||
| importer = AstrBotImporter( | ||
| mock_main_db, config_path=str(tmp_path / "cmd_config.json") | ||
| ) | ||
| importer._clear_main_db = AsyncMock() | ||
| importer._import_main_database = AsyncMock(return_value={"attachments": 1}) | ||
|
|
||
| result = await importer.import_all(str(archive)) | ||
|
|
||
| assert not result.success | ||
| assert result.imported_files["attachments"] == 0 | ||
| assert any("Failed to restore attachment" in error for error in result.errors) | ||
|
|
||
| @pytest.mark.asyncio | ||
| async def test_attachment_relocation_rejects_symlink_escape( | ||
| self, mock_main_db, tmp_path, require_symlink | ||
| ): | ||
| """Keep relocated attachment writes inside the target attachment directory. | ||
|
|
||
| Args: | ||
| mock_main_db: Database double that must not be used for a rejected file. | ||
| tmp_path: Temporary directory for the archive and restore target. | ||
| require_symlink: Fixture that skips platforms without symlink support. | ||
| """ | ||
| attachment_dir = tmp_path / "attachments" | ||
| attachment_dir.mkdir() | ||
| outside = tmp_path / "outside.txt" | ||
| outside.write_bytes(b"keep existing bytes") | ||
| (attachment_dir / "test-id.txt").symlink_to(outside) | ||
| archive = tmp_path / "backup.zip" | ||
| with zipfile.ZipFile(archive, "w") as zf: | ||
| zf.writestr("files/attachments/test-id.txt", "replacement") | ||
| importer = AstrBotImporter( | ||
| mock_main_db, config_path=str(tmp_path / "cmd_config.json") | ||
| ) | ||
| result = ImportResult() | ||
|
|
||
| with zipfile.ZipFile(archive) as zf: | ||
| count = await importer._import_attachments( | ||
| zf, | ||
| [ | ||
| { | ||
| "attachment_id": "test-id", | ||
| "path": "/old-install/data/attachments/uploaded.txt", | ||
| } | ||
| ], | ||
| result, | ||
| ) | ||
|
|
||
| assert count == 0 | ||
| assert not result.success | ||
| assert any( | ||
| "outside the attachments directory" in error for error in result.errors | ||
| ) | ||
| assert outside.read_bytes() == b"keep existing bytes" |
Contributor
There was a problem hiding this comment.
⚪ Low · New backup tests are added
The change adds new test cases to the existing test file, contrary to the instruction not to generate test files.
Remove the newly added test cases from this change.
Also at tests/test_backup.py:1162-1218.
Prompt for AI agents
In `tests/test_backup.py` at lines 632-713:
**New backup tests are added**
The change adds new test cases to the existing test file, contrary to the instruction not to generate test files.
Remove the newly added test cases from this change.
Also at `tests/test_backup.py:1162-1218`.From .github/copilot-instructions.md L27:
Do not generate test files for now.This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restoring a backup into a different data directory skipped attachments while reporting success.
Modifications / 改动点
Restore migrated attachments under the current data directory and update their database paths; preserve same-directory restores.
Report attachment restore failures and retain path traversal protection.
This is NOT a breaking change. / 这不是一个破坏性变更。
Screenshots or Test Results / 运行截图或测试结果
pytest tests/test_backup.py -q: 92 passed. Covers same/new directories, write failures, and symlink escapes; the migration test failed before the fix.ruff format .andruff check .: passed.Checklist / 检查清单
😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
/ 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。
👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
/ 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。
📚 I checked the affected WebUI instructions and screenshots in
docs/zhanddocs/enagainst the changed navigation, page structure, and labels, and updated them in this PR (or explained why no documentation update is needed). For renamed, moved, or merged entry points, I included an old entry → new entry mapping in the documentation and changelog./ 我已对照变化后的 WebUI 入口、页面结构和术语，核对并在本 PR 中更新
docs/zh和docs/en的相关操作说明与截图（或说明无需更新文档的原因）。入口改名、移动或合并时，已在文档和 changelog 中补充 旧入口 → 新入口 对照。🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in
requirements.txtandpyproject.toml./ 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到
requirements.txt和pyproject.toml文件相应位置。😮 My changes do not introduce malicious code.
/ 我的更改没有引入恶意代码。
Summary by Sourcery
Restore backup attachments safely across data-directory changes and surface failures during import.
Bug Fixes:
Enhancements:
Tests: