TL; DR
Gulu la ma phukusi a PyPI linabwereka dzina la uv, woyang'anira phukusi la Python wofulumira komanso wotchuka kwambiri wa Rust-based Python, wodzionetsera ngati othandizira a UV. Satumiza ntchito yeniyeni. Chomwe amanyamula m'malo mwake ndi Windows payload yomwe imayimira Seva ya JupyterLab yokhala ndi chitsimikizo chozimitsidwa ndipo, m'mabaibulo amtsogolo, amafalitsa pa intaneti ya anthu onse kudzera mumsewu wobwerera m'mbuyo.
Nkhani yonseyi ndi iyi: dzina la chida chodalirika ngati nyambo, ndi JupyterLab ngati injini yogwiritsira ntchito ma code akutali. Seva ya Jupyter imayendetsa khodi iliyonse yomwe mwalemba mu notebook selo; imodzi yoyambitsidwa ndi chizindikiro chopanda kanthu ndipo yolumikizidwa ku mawonekedwe onse a netiweki ndi womasulira wotseguka yemwe aliyense amene angafike pa doko angayendetse.
Timatsata gululo ngati FauxUVMaphukusi awiri omwe afufuzidwa ndi awa moon-uv (0.0.1-0.0.16) ndi my-magic-uv-helper (0.0.1), yofalitsidwa ndi woyendetsa yemweyo ndipo ikupezeka pa PyPI panthawi yowunikira.
| Makhalidwe | PyPI |
| phukusi | moon-uv (0.0.1-0.0.16), my-magic-uv-helper (0.0.1) |
| Cholinga cha nsanja | Windows |
| Khalidwe lalikulu | Seva ya JupyterLab yosatsimikizika, yofalitsidwa pa intaneti kudzera mu ngalande yobwerera m'mbuyo |
| Zida zovomerezeka zagwiritsidwa ntchito molakwika | uv, JupyterLab, cloudflared, Pinggy |
Chinyengo: dzina lomwe mumalikhulupirira kale
uv ndi chimodzi mwa zida za Python zomwe zakhazikitsidwa kwambiri m'zaka ziwiri zapitazi, kotero "chothandizira uv"Ndi phukusi lomwe wopanga mapulogalamu amayika popanda kuganiziranso kawiri. FauxUV imagwiritsa ntchito dzina limenelo modalirika. Ma phukusiwo amaphimba chenicheni uv Woyambitsa wa Astral — ma URL omwe ali pamalo olipira katundu pa malo enieni komanso odalirika — kotero kuyang'ana mwachangu sikuwona chilichonse koma maumboni odalirika. Palibe phukusi lililonse lomwe limawonjezera uv magwiridwe antchito; dzinalo ndiye chobisika chonse.
JupyterLab monga injini ya RCE
Chipinda chapakati cha katundu wolipira ndi choyambitsa chomwe chimayambitsa JupyterLab ndi chotchingira chilichonse chochotsedwa:
jupyter server --with jupyterlab --ip=0.0.0.0 # listen on every interface --ServerApp.token="" # no password, no token --allow_origin='*' # accept cross-origin connections --disable_check_xsrf # allow a remote browser/WebSocket to drive itMbendera iliyonse imachotsa chitetezo, ndipo zolemba zomwe zatumizidwa zimazilembanso (mu Chitchaina choyambirira): chizindikiro chopanda kanthu "zimatseka mawu achinsinsi ndi macheke a token — aliyense akhoza kulumikizana." JupyterLab ndi IDE yovomerezeka ya sayansi ya data, koma siebook selo limagwiritsa ntchito code yosasinthika mwa kapangidwe kake. Yakonzedwa motere ndipo imalumikizidwa ku 0.0.0.0, imasiya kukhala IDE ndipo imakhala chipolopolo chakutali chosatsimikizika pa host — sipafunika pulogalamu yaumbanda yapadera, chida chachikulu chimangoyang'ana molakwika.
Zidutswa ziwiri zothandizira zimapangitsa kuti zikhale zotheka kuzifikira komanso kuzibwerezabwereza:
- Choyambitsa chokhazikitsa mwakachetechete. Mabaibulo oyambirira amagwiritsa ntchito PowerShell -ExecutionPolicy Bypass molunjika kuchokera setup.py on pip kukhazikitsa, kumbuyo ndi zolakwika zotsekedwa kotero pip zikuwoneka bwino. Mabaibulo amtsogolo amasuntha buku loyambirira lomwelo kukhala pip-uv chida cha mzere wolamula - ndikusiya nthawi yokhazikitsa yokha kuti igwire ntchito.
- Ngalande yozungulira anthu onse. Seva yayatsidwa 0.0.0.0 imapezekabe ndi ma host okha omwe angathe kupita ku makinawo. Module yolumikizidwa imatsegula [Pinggy](https://pinggy.io/) SSH reverse tunnel yomwe imatumiza doko la Jupyter lapafupi ku adilesi ya anthu onse, ndikuchotsa malirewo. Script yotumizidwayo imanyamulanso — ndemanga — njira ina yogwiritsira ntchito Cloudflare's mitambo yayaka ndi neth port-proxy ku Linode IP, kulemba cholinga chomwecho kudzera mu zomangamanga zosiyanasiyana.
Konzani pamodzi: ikani phukusili, ndipo woyang'anira Windows amatha kuyendetsa JupyterLab yopanda mawu ndikuifalitsa pa intaneti yotseguka.
Momwe FauxUV idasinthira
Mabaibulo a FauxUV anatumizidwa mofulumira kwambiri, ndipo malo oyambira a pulogalamu yolipirira anadutsa pa iwo — chikumbutso chakuti mtundu umodzi wodziwika bwino nthawi zambiri sumafotokoza nkhani yonse ya mzere wa phukusi.
Chochititsa chidwi n'chakuti, nthawi yokhazikitsa yokha inali yoyendetsedwa kuchotsedwa m'mitundu yaposachedwa, yokhoza bwino - kotero sikirini inali ndi makiyi okha pa moyo wonse hooks angalandire ma release atsopano ngati Zochepa zoopsa, kwenikweni kumbuyo.
Zizindikiro za mgwirizano
Yatsimikiziridwa powerenga komwe phukusili lachokera; malo omalizira alembedwa Ndemanga Zilipo m'mafayilo koma sizinagwiritsidwe ntchito ndi mtundu womwe wafufuzidwa. Zizindikiro za netiweki zasinthidwa.
Zizindikiro za khalidwe loyenera kuchenjezedwa, popanda zingwe zenizeni izi: a pip kukhazikitsa zomwe zimabereka powershell -ExecutionPolicy Bypasschilichonse jupyter kuyambitsa kuphatikiza chizindikiro =”” ndi –ip=0.0.0.0ndi SSH yotuluka kupita ku *.pinggy.io kuchokera kwa wopanga mapulogalamu kapena makina a CI.
Khalidwe ndi chiyambi chowonedwa
Ma phukusi awiriwa ali ndi wolemba ndi njira imodzi: dzina la chida chodalirika, kutsekereza kwa Windows kokha, kuletsa zolakwika kumbuyo, komanso kudalira zida zodalirika kotero kuti mukayang'ana mwachangu muwona ma URL odalirika okha. Gweroli lili ndi ndemanga za Chitchaina zomwe zikufotokoza momveka bwino za mbendera zokhudzana ndi chitetezo; timanena kuti ndi mawu owoneka bwino mufayilo, osati ngati chonena chokhudza cholinga. allow_origin mtengo ndi colab.bat filename imabwereza njira zosavomerezeka za "share my local runtime" zomwe zimayendera Google Colab. Kaya chiyambi chake ndi chotani, zotsatira zake ndi zomwezo.
Zotsatira ndi malangizo kwa oteteza
Ndani akukumana ndi FauxUV. Opanga Windows ndi oyambitsa CI omwe pip kukhazikitsa imodzi mwa maphukusi awa. JupyterLab yopanda mawu achinsinsi ili pa 0.0.0.0 ndi kukhazikitsidwa kwa ma code akutali kwa aliyense amene angafike pa doko; ngalandeyo imachotsa malire a "amene angafike". Seva imagwira ntchito ngati wogwiritsa ntchito wokhazikitsa, ndikulandira mafayilo, ma tokeni, ndi zizindikiritso za mtambo za wogwiritsa ntchitoyo.
Chifukwa chake n'zosavuta kuphonya. Chingwe chilichonse cha netiweki chimayang'ana pa wolandila wodalirika - Astral, JupyterLab, mitambo yayaka, Pingggy, Colab. Palibe pulogalamu yaumbanda ya binary ku hash ndipo palibe blob yobisika yoti muzindikire. Kusanthula mbiri ndi siginecha zonse ziwiri sizikuchepetsa izi, ndichifukwa chake funso la khalidwe — Kodi kukhazikitsa phukusili kumachita chiyani? — ndiye amene amachigwira.
Chitsogozo:
- Chitani chilichonse chomwe chimachitika nthawi iliyonse yokhazikitsa powershell -ExecutionPolicy Bypass ngati chizindikiro chosweka, chilichonse chomwe chingatenge URL.
- Chenjezo layatsidwa jupyter idayambitsidwa ndi chizindikiro chopanda kanthu ndipo –ip=0.0.0.0; kuphatikiza kumeneko sikuyenera kuwonekera pa malo ogwirira ntchito kapena pa runner.
- Yang'anirani opereka chithandizo cha SSH kupita ku tunnel (*.pinggy.io, *.trycloudflare.com) kuchokera ku malo opanga mapulogalamu ndi CI.
- Sakani uv kuchokera [kuchokera ku gwero lake lovomerezeka](https://docs.astral.sh/uv/) ndipo musamakayikire ma phukusi a "helper" a chipani chachitatu omwe amakulunga chida chomwe sichili chosavuta kuchiyika.
- Pin ndikuwunikanso kudalira pakukweza — mzere wa phukusi ukhoza kukulitsa kuthekera kwatsopano kwa mtundu wowonjezera.
