fix: 增加预启动命令前的确认步骤#3050
Open
lhx077 wants to merge 1 commit into
Open
Conversation
pcl-ce-automation
Bot
added
🛠️ 等待审查
审阅者指南在执行每实例预启动命令之前增加一个确认对话框以降低 RCE 风险，并将其接入实例命令流程，同时为该提示添加新的本地化字符串。 实例预启动命令确认的时序图sequenceDiagram
participant ModLaunch
participant Config
participant ModBase
participant ModMain
participant Lang
ModLaunch->>Config: read PreLaunchCommand[PathInstance]
alt instance command not empty
ModLaunch->>ModLaunch: ArgumentReplace(customCommandVersion, true)
ModLaunch->>ModBase: RunInUiWait(callback)
ModBase->>ModMain: MyMsgBox(message, title, runText, skipText, isWarn)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Message)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Title)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Run)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Skip)
ModMain-->>ModBase: result (1 for Run, other for Skip)
ModBase-->>ModLaunch: confirmed flag
alt confirmed is false
ModLaunch->>ModLaunch: McLaunchLog("已跳过实例自定义命令：" + command)
ModLaunch->>ModLaunch: customCommandVersion = ""
end
end
ModLaunch->>ModLaunch: continue launch and script export with customCommandGlobal and customCommandVersion
文件级更改
提示与命令与 Sourcery 交互
自定义你的体验访问你的 控制面板 来：
获取帮助Original review guide in EnglishReviewer's GuideAdds a confirmation dialog before executing per-instance pre-launch commands to mitigate RCE risk, and wires it into the instance command path along with new localized strings for the prompt. Sequence diagram for instance pre-launch command confirmationsequenceDiagram
participant ModLaunch
participant Config
participant ModBase
participant ModMain
participant Lang
ModLaunch->>Config: read PreLaunchCommand[PathInstance]
alt instance command not empty
ModLaunch->>ModLaunch: ArgumentReplace(customCommandVersion, true)
ModLaunch->>ModBase: RunInUiWait(callback)
ModBase->>ModMain: MyMsgBox(message, title, runText, skipText, isWarn)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Message)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Title)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Run)
ModMain->>Lang: Text(Minecraft.Launch.CustomCommand.InstanceConfirm.Skip)
ModMain-->>ModBase: result (1 for Run, other for Skip)
ModBase-->>ModLaunch: confirmed flag
alt confirmed is false
ModLaunch->>ModLaunch: McLaunchLog("已跳过实例自定义命令：" + command)
ModLaunch->>ModLaunch: customCommandVersion = ""
end
end
ModLaunch->>ModLaunch: continue launch and script export with customCommandGlobal and customCommandVersion
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - 我在这里给出了一些总体反馈：
ConfirmInstancePreLaunchCommand的日志消息被硬编码为中文（"已跳过实例自定义命令"）；建议改用本地化字符串 key，这样日志输出就能与当前 UI 语言保持一致。- 在确认对话框中展示完整的预启动命令，对于较长或复杂的命令可能会比较臃肿；可以考虑对命令进行截断或调整展示方式（例如使用可滚动文本区域，或者简短预览并提供查看完整内容的方式），以保持对话框的可用性。
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `ConfirmInstancePreLaunchCommand` log message is hard-coded in Chinese (`"已跳过实例自定义命令"`); consider using a localized string key so the log output matches the current UI language.
- Displaying the full pre-launch command in the confirmation dialog may become unwieldy for long or complex commands; consider truncating or formatting the command (e.g., scrollable text area or shortened preview with a way to see full content) to keep the dialog usable.帮我变得更有用！请对每条评论点 👍 或 👎，我会根据你的反馈改进后续的代码审查。
Original comment in English
Hey - I've left some high level feedback:
- The
ConfirmInstancePreLaunchCommandlog message is hard-coded in Chinese ("已跳过实例自定义命令"); consider using a localized string key so the log output matches the current UI language. - Displaying the full pre-launch command in the confirmation dialog may become unwieldy for long or complex commands; consider truncating or formatting the command (e.g., scrollable text area or shortened preview with a way to see full content) to keep the dialog usable.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `ConfirmInstancePreLaunchCommand` log message is hard-coded in Chinese (`"已跳过实例自定义命令"`); consider using a localized string key so the log output matches the current UI language.
- Displaying the full pre-launch command in the confirmation dialog may become unwieldy for long or complex commands; consider truncating or formatting the command (e.g., scrollable text area or shortened preview with a way to see full content) to keep the dialog usable.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
lhx077
changed the title
Member
|
修复无法编译问题 |
LinQingYuu
requested changes
Jun 10, 2026
| private static bool ConfirmInstancePreLaunchCommand(string command) | ||
| { | ||
| var confirmed = false; | ||
| ModBase.RunInUiWait(() => |
| ModBase.RunInUiWait(() => | ||
| confirmed = ModMain.MyMsgBox( | ||
| Lang.Text("Minecraft.Launch.CustomCommand.InstanceConfirm.Message", | ||
| ModMinecraft.McInstanceSelected?.Name ?? "", command), |
Member
There was a problem hiding this comment.
Suggested change
| ModMinecraft.McInstanceSelected?.Name ?? "", command), | |
| ModInstanceList.McInstanceSelected?.Name ?? "", command), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
cmd.exe, creating an RCE risk when users import or open untrusted instance/modpack folders.Description
ConfirmInstancePreLaunchCommand(string)toModLaunchto show a warning dialog and ask the user toRunorSkipan instance-supplied pre-launch command.ArgumentReplacethen validated byConfirmInstancePreLaunchCommand, and if the user declines the command is cleared so it will not be executed or written to exported launch scripts.Minecraft.Launch.CustomCommand.InstanceConfirm.*) inPCL.Core/App/Localization/Languages/en-US.xamlandPCL.Core/App/Localization/Languages/zh-CN.xaml.Testing
xml.etree.ElementTree.parseto validate XML well-formedness, and the check succeeded.git diff --checkto ensure no whitespace/error diff issues, and it reported no problems.dotnet --infoto run a build verification but it failed in the environment with/bin/bash: dotnet: command not found, so no project build was executed.Codex Task
由 Sourcery 提供的摘要
在运行每个实例的预启动命令之前，增加一个确认步骤，以减少无意或不安全命令被执行的风险。
新功能：
文档：
Original summary in English
Summary by Sourcery
Add a confirmation step before running per-instance pre-launch commands to mitigate unintended or unsafe command execution.
New Features:
Documentation: