TL, DR
Wani rukuni na fakitin PyPI ya ɗauki sunan uv, mai sarrafa kunshin Python mai sauri da shahara sosai wanda ke tushen Rust, don yin kamar masu taimakawa UV. Ba sa aika da wani aiki na gaske. Abin da suke ɗauka a maimakon haka shine kayan aikin Windows wanda ke tsaye Sabar JupyterLab tare da kashe tabbatarwa kuma, a cikin sigar da ta biyo baya, suna buga shi zuwa ga jama'a ta intanet ta hanyar ramin juyawa.
Wannan shine labarin gaba ɗaya a layi ɗaya: Sunan kayan aiki da aka amince da shi a matsayin abin jan hankali, da kuma JupyterLab a matsayin injin aiwatar da lambar nesa. Sabar Jupyter tana gudanar da duk wani lambar da ka rubuta a cikin "not"ebook wayar salula; wanda aka ƙaddamar da alamar da babu komai a ciki kuma aka ɗaure shi zuwa kowace hanyar sadarwa, fassarar buɗe ce da duk wanda zai iya isa tashar jiragen ruwa zai iya tuƙi.
Muna bin diddigin ƙungiyar kamar yadda Na'urar UV ta bogiFakitin guda biyu da aka bincika sune moon-uv (0.0.1-0.0.16) da kuma my-magic-uv-helper (0.0.1), wanda mai aiki ɗaya ya buga kuma kai tsaye akan PyPI a lokacin bincike.
| Kayan daji | PyPI |
| Pakete | moon-uv (0.0.1-0.0.16), my-magic-uv-helper (0.0.1) |
| An yi niyya ga dandamali | Windows |
| Babban ɗabi'a | Sabar JupyterLab mara inganci, an buga ta intanet ta hanyar ramin juyawa |
| An yi amfani da kayan aikin da aka halatta | uv, JupyterLab, cloudflared, Pinggy |
Sha'awar: sunan da ka riga ka amince da shi
uv yana ɗaya daga cikin kayan aikin Python da aka fi shigar da su a cikin shekaru biyu da suka gabata, don haka "mai taimako ga uv"fakitin da mai haɓakawa ke shigarwa ba tare da wani tunani ba. FauxUV yana amfani da amincinsa gaba ɗaya akan wannan sunan. Fakitin yana rufe gaske uv mai sakawa daga Astral — URLs ɗin da ke cikin wurin ɗaukar nauyi a ainihin masu masaukin baki masu suna — don haka duba cikin sauri ba ya ganin komai sai nassoshi masu aminci. Babu ɗayan fakitin da ya ƙara da gaske. uv aiki; sunan shine dukkan ɓoyewa.
JupyterLab a matsayin injin RCE
Babban abin da ke cikin kayan aikin shine na'urar harbawa wadda ke fara JupyterLab tare da cire duk wani shingen tsaro:
jupyter server --with jupyterlab --ip=0.0.0.0 # listen on every interface --ServerApp.token="" # no password, no token --allow_origin='*' # accept cross-origin connections --disable_check_xsrf # allow a remote browser/WebSocket to drive itKowace tuta tana cire kariya, kuma rubutun da aka aika ma yana bayyana su (a cikin asalin Sinanci): alamar da babu komai a ciki "Yana kashe kalmar sirri da duba alamun kuɗi - kowa zai iya haɗawa." Tsakar Gida halaltaccen IDE ne na kimiyyar bayanai, amma baebook Tantanin halitta yana aiwatar da lambar da ba ta dace ba ta hanyar ƙira. An saita ta wannan hanyar kuma an ɗaure ta zuwa 0.0.0.0, ya daina zama IDE kuma ya zama harsashi mai nisa mara izini akan mai masaukin baki - babu buƙatar binary na malware na musamman, kawai kayan aiki na yau da kullun yana nuna hanya mara kyau.
Abubuwa biyu masu tallafi suna sa hakan ya zama mai sauƙin isa da kuma maimaituwa:
- Abin kunna shigarwa shiru. Sigogi na farko suna aiki da PowerShell tare da -ExecutionPolicy Tafe kai tsaye daga saita.py on shigar pip, a bango tare da kurakurai da aka danne don haka pip yana kama da na al'ada. Sigogi na baya suna motsa irin wannan asali zuwa pip-uv kayan aikin layin umarni - kuma ka sauke lokacin shigarwa ta atomatik gaba ɗaya.
- Ramin juyawa na jama'a. Sabar tana kan 0.0.0.0 Mai masaukin baki ne kawai zai iya isa gare shi wanda zai iya zuwa na'urar. Wani kayan aiki mai haɗe yana buɗe [Pinggy](https://pinggy.io/) Ramin juyawa na SSH wanda ke tura tashar jiragen ruwa ta Jupyter ta gida zuwa adireshin jama'a, yana cire wannan iyaka. Rubutun da aka aika kuma yana ɗauke da — sharhi — wata hanya ta daban ta amfani da Cloudflare's girgije mai walƙiya kuma a netsh wakili na tashar jiragen ruwa zuwa Linode IP, yana rubuta manufa ɗaya ta hanyar kayayyakin more rayuwa daban-daban.
A haɗa: shigar da fakitin, kuma mai masaukin Windows zai ƙare yana gudanar da JupyterLab mara kalmar sirri kuma ya buga shi a intanet.
Yadda FauxUV ya samo asali
Sigar FauxUV ta shigo da sauri a jere, kuma wurin da aka ɗora kayan ya ratsa su - abin tunatarwa ne cewa sigar da aka yiwa alama ba kasafai take ba da labarin layin fakiti ba.
A bayyane yake cewa lokacin shigarwa, an saita tsarin ta atomatik. cire a cikin sigar da ta gabata, mafi inganci - don haka na'urar daukar hoto tana makulli ne kawai akan zagayowar rayuwa hooks zai sanya sabbin fina-finai a matsayin Kadan mai haɗari, daidai da baya.
Alamomin sulhu
An tabbatar da shi ta hanyar karanta tushen fakitin; an yiwa alama a ƙarshen maki sharhi suna nan a cikin fayilolin amma ba a aiwatar da su ta hanyar sigar da aka yi nazari ba. Ana cire alamun hanyar sadarwa.
Siginar ɗabi'a da ta cancanci a faɗakar da ita, ba tare da la'akari da waɗannan takamaiman igiyoyi ba: shigar pip wanda ke haifarwa powershell - Tsarin Aiwatarwa Kewaya; kowane Jupyter haɗawar ƙaddamarwa alama = "" tare da –ip=0.0.0.0; da kuma fita daga SSH zuwa *.pinggy.io daga injin mai haɓakawa ko injin CI.
An lura da yanayin da asalinsa
Fakitin guda biyu suna da mawallafi da kuma hanya: sunan kayan aiki mai aminci, ɓoye bayanai na Windows kawai, aiwatar da bayanan da aka hana kurakurai, da kuma dogaro da kayan aiki masu inganci don haka duba cikin sauri zai ga URLs masu inganci kawai. Tushen yana ɗauke da sharhin yaren Sinanci wanda ke bayyana alamun tsaro a sarari; muna bayar da rahoton waɗannan a matsayin kalamai masu kyau a cikin fayil ɗin, ba a matsayin da'awa game da dalili ba. allow_origin daraja da kuma a colab.bat Sunan fayil ɗin yana maimaita ayyukan aiki na "raba lokacin aiki na gida" waɗanda ke yawo a Google Colab. Ko menene asalin, sakamakon da aka tattara iri ɗaya ne.
Tasiri da jagora ga masu kare
Wanda ke fuskantar matsalar rashin lafiyar fata (FuxUV). Masu haɓaka Windows da masu gudanar da CI waɗanda ke shigar pip Ɗaya daga cikin waɗannan fakitin. JupyterLab mara kalmar sirri akan 0.0.0.0 aiwatar da lambar nesa ne ga duk wanda zai iya isa tashar jiragen ruwa; ramin yana cire iyakar "wanda zai iya isa gare ta". Sabar tana aiki a matsayin mai shigar da kaya, tana gadar fayilolin mai amfani, alamun, da bayanan girgije.
Me yasa yake da sauƙin rasawa? Kowace hanyar sadarwa tana nuna zuwa ga wani mai masaukin baki mai suna — Astral, JupyterLab, girgije mai walƙiya, Pinggy, Colab. Babu wani nau'in malware zuwa hash kuma babu wani ɓoye mai ɓoye don fassarawa. Dubawa mai suna da sa hannu duka suna rage wannan nauyi, shi ya sa tambayar ɗabi'a - me shigar da wannan kunshin ke sa injin ya yi? - shine wanda ya kama shi.
Jagora:
- Yi amfani da duk lokacin shigarwa powershell - Tsarin Aiwatarwa Kewaya a matsayin siginar karya gini, duk wani URL da ya ɗauka.
- An kunna faɗakarwa Jupyter an ƙaddamar da alamar komai kuma –ip=0.0.0.0; bai kamata wannan haɗin ya bayyana a kan wurin aiki ko mai gudu ba.
- Mai saka idanu ga masu samar da SSH daga nesa zuwa rami (*.pinggy.io, *.trycloudflare.com) daga mahalli masu haɓakawa da CI.
- shigar uv daga [tushensa na hukuma](https://docs.astral.sh/uv/) kuma ku yi shakkar fakitin "mai taimako" na wasu kamfanoni waɗanda ke naɗe kayan aiki da ya riga ya zama ba shi da mahimmanci a shigar.
- Raba da sake duba abubuwan da suka dogara da haɓakawa - layin fakiti na iya haɓaka sabon iyawa na sigar-kan-sigar.
