API 的插件框架

web/handlers/__init__.py

@@ -5,9 +5,8 @@
 #         http://binux.me
 # Created on 2012-12-15 16:15:50
 
-import os
-import sys
 import importlib
+import os
 import pkgutil
 
 from . import base

web/handlers/about.py

@@ -5,9 +5,9 @@
 #         http://binux.me
 # Created on 2014-08-08 21:06:02
 
-from .base import *
 from . import api
-from .api import MultiArgument, BodyArgument
+from .api import BodyArgument, MultiArgument
+from .base import *
 
 
 class AboutHandler(BaseHandler):

web/handlers/api/__init__.py

@@ -1,30 +1,31 @@
-import os
+import importlib
 import json
+import os
 import pkgutil
-import importlib
 import typing
-from typing import Iterable, Callable
-import dataclasses
-from dataclasses import dataclass
-from functools import partial
 from collections import defaultdict
+from dataclasses import dataclass
+from html import escape
+from typing import Callable, Iterable
 
 from tornado.web import HTTPError
 
-from ..base import BaseHandler
 from libs.safe_eval import safe_eval
 
+from ..base import BaseHandler, logger_Web_Handler
 
 URL_PREFIX = "/v1/"
 
 BaseType = typing.Union[str, int, float, bool, None]
 
 
 class ApiError(HTTPError):
-    def __init__(self, status_code: int, reason: str, *args, **kwargs):
+    def __init__(self, status_code: int, reason: str, log_message :str | None = None, *args, **kwargs):
         # 对于 HTTPError，log_message 是打印到控制台的内容，reason 是返回给用户的内容
         # 我们希望 API 的用户可以直接从 Web 界面看到错误信息，所以将 log_message 和 reason 设置为相同的内容
-        super().__init__(status_code, reason, reason=reason, *args, **kwargs)
+        if log_message is None:
+            log_message = reason
+        super().__init__(status_code, log_message=log_message, reason=reason, *args, **kwargs)
 
 
 @dataclass()
@@ -213,7 +214,7 @@ def api_write(self, data):
             if len(data) == 1:
                 # 如果只有一个键值对，直接返回值
                 # 不递归处理，默认 API 不会返回过于复杂的类型
-                self.write(tuple(data.values())[0])
+                self.write(str(tuple(data.values())[0]))
             else:
                 # 如果有多个键值对，返回 JSON
                 self.api_write_json(data)
@@ -230,10 +231,14 @@ def api_write(self, data):
             # 其他类型转换为 JSON
             self.api_write_json(data)
 
-    def api_write_json(self, data: dict[str, typing.Any], ensure_ascii=False, indent=4):
+    def api_write_json(self, data: dict[str, typing.Any], ensure_ascii=False, indent=4, escape_html=False, escape_quote=True):
         """将 json 数据写入响应"""
         self.set_header("Content-Type", "application/json; charset=UTF-8")
-        self.write(json.dumps(data, ensure_ascii=ensure_ascii, indent=indent))
+        if escape_html:
+            data = escape(json.dumps(data, ensure_ascii=ensure_ascii, indent=indent), quote=escape_quote)
+        else:
+            data = json.dumps(data, ensure_ascii=ensure_ascii, indent=indent).replace('</', '<\\/')
+        self.write(data)
 
 
 def api_wrap(

web/handlers/api/example.py

@@ -1,11 +1,13 @@
 import json
 import traceback
 import typing
+from html import escape
 
 import config
 
-from . import ApiBase, Argument, MultiArgument, BodyArgument, api_wrap, ApiError
-
+from ..base import logger_Web_Handler
+from . import (ApiBase, ApiError, Argument, BodyArgument, MultiArgument,
+               api_wrap)
 
 # API 插件设计准则：
 # - 路径为 /api/name（旧版保持原先的 /util/name）
@@ -42,15 +44,15 @@
 # 最简单的 API 示例
 class Echo1(ApiBase):
     api_name = "回声"
-    api_description = "输出 = 输入"  # 支持 HTML 标签，比如 <br/>
+    api_description = "输出 = 输入"  # 不支持 HTML 标签，比如 <br/>
     api_url = "echo1"  # 框架会自动添加前缀 /api/
 
     @api_wrap(
         arguments=(Argument(name="text", description="输入的文字", required=True),),
         example={"text": "hello world"},
     )
     async def get(self, text: str):
-        return text
+        return escape(text)
 
     post = get
 
@@ -66,7 +68,7 @@ class Echo2(ApiBase):
         example={"text": "hello world"},
     )
     async def get(self, text: str):
-        return text
+        return escape(text)
 
     # 不提供 example 的示例
     @api_wrap(
@@ -75,7 +77,7 @@ async def get(self, text: str):
         ),
     )
     async def post(self, text: bytes):
-        return text
+        return escape(text)
 
 
 # __filter__ 和 直接设置 example_display 的示例
@@ -174,8 +176,6 @@ async def get(self, code: int, reason: str):
             try:
                 eee = 9 / 0
             except ZeroDivisionError as e:
-                if config.traceback_print:
-                    traceback.print_exc()  # 根据全局设置决定是否在控制台打印完整报错信息
                 raise ApiError(500, str(e))  # 还是返回 500，但是前端有报错原因，控制台打印简短信息
         else:
             raise ApiError(code, reason)
@@ -235,7 +235,7 @@ class Echo0(ApiBase):
     async def get(self):
         # 使用原生 tornado API，详细参考 tornado 文档
         text = self.get_argument("text", "")
-        self.write(text)
+        self.write(escape(text))
 
     # 此处的声明只用于生成前端文档
     get.api = {
@@ -246,4 +246,4 @@ async def get(self):
     post = get
 
 
-handlers = (Echo1, Echo2, Echon, Concat, Sum, Example, Json, Echo0)
+handlers = (Echon, Concat, Sum, Example, Json)

web/tpl/about.html

@@ -50,7 +50,7 @@ <h2>
       <tr>
         <td rowspan="{{ rowspan }}">{{ api.api_name }}</td>
         <td rowspan="{{ rowspan }}" class="showbut" id="api_url{{i}}">
-          <a href="{{ api.api_url }}" target="_blank" rel="nofollow">api:/{{ api.api_url }}</a>
+          <a href="{{ api.api_url }}" target="_blank" rel="nofollow noopener noreferrer">api:/{{ api.api_url }}</a>
           <button class="btn hljs-button" data-clipboard-target="#api_url{{i}}">复制</button>
         </td>
         <td rowspan="{{ rowspan }}">{{ api.api_description | safe }}</td>
@@ -79,7 +79,7 @@ <h2>
           {% endif %}
 
           <td rowspan="{{ 1 if args == 0 else args }}" class="showbut autowrap" id="api_exam{{i}}">
-            <a href="{{ method['example'] }}" target="_blank" rel="nofollow">api:/{{ method['example'] }}</a>
+            <a href="{{ method['example'] }}" target="_blank" rel="nofollow  noopener noreferrer">api:/{{ method['example'] }}</a>
             <button class="btn hljs-button" data-clipboard-target="#api_exam{{i}}">复制</button>
           <td>
           </tr>