feat(阶段4): 测试用例压缩包上传与下载
POST admin/test-cases GET admin/problems/:id/test-cases （返回 zip 二进制） 落盘格式必须与判题沙箱镜像的约定一致（沙箱直接读挂进去的目录），已用真判题验证： 上传 zip → 建题 → 提交 Python 解法 → 沙箱读到用例并判出 Accepted。 安全与健壮性上比旧后端多做的几件事： - **zip slip 从设计上进不来**：不遍历压缩包条目，只按精确文件名（`N.in`/`N.out`/`N.sql`） 取内容，条目名一律不参与路径拼接。实测带 `../../etc/passwd` 条目的包能正常处理， 且只取到 1.in/1.out。 - 单文件 32MB、解压后总量 128MB、测试点数 500 的上限，防 zip bomb 与写满磁盘 —— 旧后端一概没有，机房那台机器盘写满之后判题也会一起挂。 - 坏 zip 返回 400 而不是 500。 对齐旧后端的细节：CRLF→LF 归一；`stripped_output_md5` 按 Python `bytes.rstrip()` 的口径只剥尾部 ASCII 空白后再算（实测与 hashlib.md5 结果一致）；编号从 1 起连续、 遇缺口即停；SQL 包至少 2 个测试点（题目页会展示测试点 1 的期望结果，只有一个时 学生可以对照着硬编码 AC）；目录 0710、文件 0640。 ## 顺带修掉一个只在判题时才暴露的路径 bug config 里的相对路径（data/test_case、data/avatar、data/upload）原先按进程 cwd 解析， 而起服务的方式会把 cwd 切到 apps/api/，于是测试点落在 apps/api/data/ 下 —— 但 docker/compose.dev.yml 把**仓库根**的 data/test_case 挂进判题沙箱。两边不是同一个 目录，新传的测试点判题时会「找不到测试数据」，且只在真正判题时才暴露。 改成一律按仓库根解析，实测沙箱能看到新传的目录。 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
@@ -18,6 +18,7 @@
|
||||
"@oj2/contract": "workspace:*",
|
||||
"bullmq": "^6.0.9",
|
||||
"drizzle-orm": "^0.45.2",
|
||||
"fflate": "^0.8.3",
|
||||
"hono": "^4.0.0",
|
||||
"ioredis": "^6.0.0",
|
||||
"postgres": "^3.4.0",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { randomBytes } from "node:crypto"
|
||||
import { readFileSync } from "node:fs"
|
||||
import { resolve } from "node:path"
|
||||
import { isAbsolute, resolve } from "node:path"
|
||||
|
||||
/**
|
||||
* Bun 只自动加载「当前工作目录」下的 .env。而本应用的启动方式（`bun run --filter '@oj2/api' dev`）
|
||||
@@ -34,6 +34,18 @@ loadRepoRootEnv()
|
||||
* env 缺失时生成随机值 fail-safe —— 宁可判题机连不上（启动时有明显告警），
|
||||
* 也不要在仓库里写死一个人人都知道的弱默认值。
|
||||
*/
|
||||
/**
|
||||
* 相对路径一律按**仓库根**解析，而不是进程 cwd。
|
||||
*
|
||||
* 起服务的方式（`bun run --filter '@oj2/api' dev`）会把 cwd 切到 apps/api/，
|
||||
* 于是 "data/test_case" 落在 apps/api/data/ 下 —— 而 docker/compose.dev.yml 把
|
||||
* 仓库根的 data/test_case 挂进判题沙箱。两边不是同一个目录，新传的测试点判题时
|
||||
* 会「找不到测试数据」，而且只在真正判题时才暴露。
|
||||
*/
|
||||
function repoPath(value: string) {
|
||||
return isAbsolute(value) ? value : resolve(import.meta.dir, "../../..", value)
|
||||
}
|
||||
|
||||
function judgeServerToken() {
|
||||
const fromEnv = process.env.JUDGE_SERVER_TOKEN
|
||||
if (fromEnv) return fromEnv
|
||||
@@ -54,10 +66,10 @@ export const config = {
|
||||
judgeServerUrl: process.env.JUDGE_SERVER_URL ?? "http://localhost:8081",
|
||||
judgeServerToken: judgeServerToken(),
|
||||
judgeConcurrency: Number(process.env.JUDGE_CONCURRENCY ?? 2),
|
||||
avatarDirectory: process.env.AVATAR_DIRECTORY ?? "data/avatar",
|
||||
avatarDirectory: repoPath(process.env.AVATAR_DIRECTORY ?? "data/avatar"),
|
||||
// 判题沙箱把这个目录挂成只读的 /test_case，两边必须指同一处
|
||||
testCaseDirectory: process.env.TEST_CASE_DIRECTORY ?? "data/test_case",
|
||||
uploadDirectory: process.env.UPLOAD_DIRECTORY ?? "data/upload",
|
||||
testCaseDirectory: repoPath(process.env.TEST_CASE_DIRECTORY ?? "data/test_case"),
|
||||
uploadDirectory: repoPath(process.env.UPLOAD_DIRECTORY ?? "data/upload"),
|
||||
uploadUriPrefix: process.env.UPLOAD_URI_PREFIX ?? "/public/upload",
|
||||
avatarUriPrefix: process.env.AVATAR_URI_PREFIX ?? "/public/avatar",
|
||||
aiBaseUrl: process.env.AI_BASE_URL ?? "https://api.deepseek.com",
|
||||
|
||||
@@ -6,6 +6,7 @@ import {
|
||||
createProblemRequestSchema,
|
||||
makeProblemPublicRequestSchema,
|
||||
updateProblemRequestSchema,
|
||||
uploadTestCaseResponseSchema,
|
||||
} from "@oj2/contract"
|
||||
import { and, count, desc, eq, ilike, inArray, isNull, ne, or, sql } from "drizzle-orm"
|
||||
import { Hono } from "hono"
|
||||
@@ -15,6 +16,7 @@ import type { AuthUser } from "../../auth/session"
|
||||
import { db, schema } from "../../db"
|
||||
import { failure, success } from "../../http"
|
||||
import { contestStatus } from "../../services/contest"
|
||||
import { packTestCaseZip, processTestCaseZip, TestCaseError } from "../../services/test-case"
|
||||
import { objectValue, queryInteger, sampleUser, stringArray } from "../helpers"
|
||||
|
||||
export const adminProblemRoutes = new Hono<AppEnv>()
|
||||
@@ -526,3 +528,44 @@ adminProblemRoutes.post("/contests/:contestId/problems/from-public", requireProb
|
||||
})
|
||||
return success(c, await serialize(created), 201)
|
||||
})
|
||||
|
||||
// ---------------------------------------------------------------- 测试用例
|
||||
|
||||
adminProblemRoutes.post("/test-cases", requireProblemPermission, async (c) => {
|
||||
const form = await c.req.formData().catch(() => null)
|
||||
const file = form?.get("file")
|
||||
if (!(file instanceof File)) return failure(c, 400, "invalid-request", "Upload failed")
|
||||
const sql = ["1", "true", "True"].includes(String(form?.get("sql") ?? ""))
|
||||
try {
|
||||
const result = await processTestCaseZip(new Uint8Array(await file.arrayBuffer()), { sql })
|
||||
return success(c, uploadTestCaseResponseSchema.parse({
|
||||
id: result.testCaseId,
|
||||
info: result.info,
|
||||
}), 201)
|
||||
} catch (error) {
|
||||
if (error instanceof TestCaseError) return failure(c, 400, "invalid-test-case", error.message)
|
||||
console.error("Failed to process test case zip", error)
|
||||
return failure(c, 500, "test-case-error", "测试点处理失败")
|
||||
}
|
||||
})
|
||||
|
||||
adminProblemRoutes.get("/problems/:id/test-cases", requireProblemPermission, async (c) => {
|
||||
const [problem] = await db.select().from(schema.problem)
|
||||
.where(eq(schema.problem.id, queryInteger(c.req.param("id"), 0, { min: 1 }))).limit(1)
|
||||
if (!problem) return failure(c, 404, "problem-not-found", "Problem does not exists")
|
||||
if (!(await canEdit(c.get("user")!, problem))) {
|
||||
return failure(c, 404, "problem-not-found", "Problem does not exists")
|
||||
}
|
||||
try {
|
||||
const archive = await packTestCaseZip(problem.testCaseId)
|
||||
return new Response(archive, {
|
||||
headers: {
|
||||
"content-type": "application/zip",
|
||||
"content-disposition": `attachment; filename=problem_${problem.id}_test_cases.zip`,
|
||||
},
|
||||
})
|
||||
} catch (error) {
|
||||
if (error instanceof TestCaseError) return failure(c, 404, "test-case-not-found", error.message)
|
||||
throw error
|
||||
}
|
||||
})
|
||||
|
||||
220
apps/api/src/services/test-case.ts
Normal file
220
apps/api/src/services/test-case.ts
Normal file
@@ -0,0 +1,220 @@
|
||||
import { createHash } from "node:crypto"
|
||||
import { mkdir, chmod, readdir, readFile, writeFile } from "node:fs/promises"
|
||||
import { resolve } from "node:path"
|
||||
|
||||
import { unzipSync, zipSync } from "fflate"
|
||||
|
||||
import { config } from "../config"
|
||||
|
||||
/**
|
||||
* 测试点压缩包的解析与落盘。对齐旧 `problem/views/admin.py:TestCaseZipProcessor`。
|
||||
*
|
||||
* 落盘格式必须与判题沙箱镜像的约定一致 —— 沙箱直接读挂载进去的目录：
|
||||
* <test_case_id>/1.in 1.out 2.in 2.out ... info
|
||||
* `info` 里 `test_cases` 的键是从 "1" 开始的字符串序号。
|
||||
*/
|
||||
|
||||
/** 单个测试点文件上限。机房那台机器盘不大，一个失手的大文件能把判题一起拖挂 */
|
||||
const MAX_ENTRY_BYTES = 32 * 1024 * 1024
|
||||
/** 解压后总大小上限，防 zip bomb */
|
||||
const MAX_TOTAL_BYTES = 128 * 1024 * 1024
|
||||
/** 测试点数量上限 */
|
||||
const MAX_CASES = 500
|
||||
|
||||
export class TestCaseError extends Error {}
|
||||
|
||||
export interface TestCaseEntry {
|
||||
stripped_output_md5: string
|
||||
input_size: number
|
||||
output_size: number
|
||||
input_name: string
|
||||
output_name: string
|
||||
}
|
||||
|
||||
/** 等价于 Python 的 bytes.rstrip()：只剥尾部 ASCII 空白 */
|
||||
function rstrip(buffer: Uint8Array) {
|
||||
const whitespace = new Set([0x20, 0x09, 0x0a, 0x0d, 0x0b, 0x0c])
|
||||
let end = buffer.length
|
||||
while (end > 0 && whitespace.has(buffer[end - 1]!)) end -= 1
|
||||
return buffer.subarray(0, end)
|
||||
}
|
||||
|
||||
/** CRLF → LF，与旧后端 `content.replace(b"\r\n", b"\n")` 一致 */
|
||||
function normalizeNewlines(buffer: Uint8Array) {
|
||||
const out = new Uint8Array(buffer.length)
|
||||
let length = 0
|
||||
for (let i = 0; i < buffer.length; i += 1) {
|
||||
if (buffer[i] === 0x0d && buffer[i + 1] === 0x0a) continue
|
||||
out[length] = buffer[i]!
|
||||
length += 1
|
||||
}
|
||||
return out.subarray(0, length)
|
||||
}
|
||||
|
||||
/**
|
||||
* 从 1 开始找连续编号的测试点，遇到缺口就停。
|
||||
* 缺口之后的文件一律忽略 —— 与旧 `filter_name_list` 一致：编号断了说明打包出了问题，
|
||||
* 沉默地跳过一段比按乱序判题安全。
|
||||
*/
|
||||
function collectPairs(names: Set<string>) {
|
||||
const pairs: [string, string][] = []
|
||||
for (let index = 1; index <= MAX_CASES; index += 1) {
|
||||
const input = `${index}.in`
|
||||
const output = `${index}.out`
|
||||
if (!names.has(input) || !names.has(output)) break
|
||||
pairs.push([input, output])
|
||||
}
|
||||
return pairs
|
||||
}
|
||||
|
||||
function collectSqlScripts(names: Set<string>) {
|
||||
const scripts: string[] = []
|
||||
for (let index = 1; index <= MAX_CASES; index += 1) {
|
||||
const name = `${index}.sql`
|
||||
if (!names.has(name)) break
|
||||
scripts.push(name)
|
||||
}
|
||||
return scripts
|
||||
}
|
||||
|
||||
export interface ProcessedTestCase {
|
||||
testCaseId: string
|
||||
info: TestCaseEntry[]
|
||||
}
|
||||
|
||||
export async function processTestCaseZip(
|
||||
archive: Uint8Array,
|
||||
options: { sql?: boolean } = {},
|
||||
): Promise<ProcessedTestCase> {
|
||||
let files: Record<string, Uint8Array>
|
||||
try {
|
||||
files = unzipSync(archive)
|
||||
} catch {
|
||||
throw new TestCaseError("压缩包损坏或不是 zip 格式")
|
||||
}
|
||||
|
||||
// 只按「精确文件名」取内容，不遍历压缩包里的条目 ——
|
||||
// 条目名一律不参与路径拼接，zip slip（`../../etc/passwd` 这类条目名）从设计上就进不来。
|
||||
const names = new Set(Object.keys(files).filter((name) => /^\d+\.(in|out|sql)$/.test(name)))
|
||||
|
||||
const selected = options.sql ? collectSqlScripts(names) : collectPairs(names).flat()
|
||||
if (selected.length === 0) throw new TestCaseError("压缩包里没有找到从 1 开始连续编号的测试点")
|
||||
if (options.sql && selected.length < 2) {
|
||||
// 题目页会展示测试点 1 的期望结果，只有一个测试点时学生可以对照着硬编码 AC
|
||||
throw new TestCaseError("SQL 题至少需要 2 个数据不同的测试点，防止硬编码期望结果")
|
||||
}
|
||||
|
||||
let total = 0
|
||||
const contents = new Map<string, Uint8Array>()
|
||||
for (const name of selected) {
|
||||
const raw = files[name]!
|
||||
if (raw.length > MAX_ENTRY_BYTES) {
|
||||
throw new TestCaseError(`测试点 ${name} 超过 ${MAX_ENTRY_BYTES / 1024 / 1024}MB`)
|
||||
}
|
||||
const content = normalizeNewlines(raw)
|
||||
total += content.length
|
||||
if (total > MAX_TOTAL_BYTES) {
|
||||
throw new TestCaseError(`测试点总大小超过 ${MAX_TOTAL_BYTES / 1024 / 1024}MB`)
|
||||
}
|
||||
contents.set(name, content)
|
||||
}
|
||||
|
||||
const testCaseId = randomId()
|
||||
const directory = resolve(config.testCaseDirectory, testCaseId)
|
||||
await mkdir(directory, { recursive: true })
|
||||
await chmod(directory, 0o710)
|
||||
|
||||
for (const [name, content] of contents) {
|
||||
await writeFile(resolve(directory, name), content)
|
||||
await chmod(resolve(directory, name), 0o640)
|
||||
}
|
||||
|
||||
const info: TestCaseEntry[] = []
|
||||
const testCases: Record<string, TestCaseEntry> = {}
|
||||
if (options.sql) {
|
||||
// SQL 题：每个 N.sql 是一个测试点的建表+数据脚本，没有期望输出（判题时跑标准答案生成）。
|
||||
// output_name 复用同名、md5 置空，以兼容前端的测试点表格。
|
||||
selected.forEach((name, index) => {
|
||||
const entry: TestCaseEntry = {
|
||||
stripped_output_md5: "",
|
||||
input_size: contents.get(name)!.length,
|
||||
output_size: 0,
|
||||
input_name: name,
|
||||
output_name: name,
|
||||
}
|
||||
info.push(entry)
|
||||
testCases[String(index + 1)] = entry
|
||||
})
|
||||
} else {
|
||||
collectPairs(names).forEach(([input, output], index) => {
|
||||
const outputContent = contents.get(output)!
|
||||
const entry: TestCaseEntry = {
|
||||
stripped_output_md5: createHash("md5").update(rstrip(outputContent)).digest("hex"),
|
||||
input_size: contents.get(input)!.length,
|
||||
output_size: outputContent.length,
|
||||
input_name: input,
|
||||
output_name: output,
|
||||
}
|
||||
info.push(entry)
|
||||
testCases[String(index + 1)] = entry
|
||||
})
|
||||
}
|
||||
|
||||
const payload: Record<string, unknown> = { test_cases: testCases }
|
||||
if (options.sql) payload.sql = true
|
||||
const infoPath = resolve(directory, "info")
|
||||
await writeFile(infoPath, JSON.stringify(payload, null, 4), "utf8")
|
||||
await chmod(infoPath, 0o640)
|
||||
|
||||
return { testCaseId, info }
|
||||
}
|
||||
|
||||
/** 把一个测试点目录重新打包成 zip 供后台下载 */
|
||||
export async function packTestCaseZip(testCaseId: string) {
|
||||
const directory = resolve(config.testCaseDirectory, testCaseId)
|
||||
let entries: string[]
|
||||
try {
|
||||
entries = await readdir(directory)
|
||||
} catch {
|
||||
throw new TestCaseError("Test case does not exists")
|
||||
}
|
||||
const names = new Set(entries)
|
||||
const isSql = await readInfo(testCaseId).then((info) => Boolean(info?.sql)).catch(() => false)
|
||||
const selected = isSql ? collectSqlScripts(names) : collectPairs(names).flat()
|
||||
const bundle: Record<string, Uint8Array> = {}
|
||||
for (const name of [...selected, "info"]) {
|
||||
if (!names.has(name)) continue
|
||||
bundle[name] = new Uint8Array(await readFile(resolve(directory, name)))
|
||||
}
|
||||
return zipSync(bundle)
|
||||
}
|
||||
|
||||
export async function readInfo(testCaseId: string) {
|
||||
const path = resolve(config.testCaseDirectory, testCaseId, "info")
|
||||
try {
|
||||
return JSON.parse(await readFile(path, "utf8")) as {
|
||||
sql?: boolean
|
||||
test_cases?: Record<string, TestCaseEntry>
|
||||
}
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
/** 读回 SQL 测试点的脚本内容，供后台回显 */
|
||||
export async function readSqlScripts(testCaseId: string) {
|
||||
const directory = resolve(config.testCaseDirectory, testCaseId)
|
||||
const names = collectSqlScripts(new Set(await readdir(directory)))
|
||||
const scripts: { name: string; content: string }[] = []
|
||||
for (const name of names) {
|
||||
scripts.push({ name, content: await readFile(resolve(directory, name), "utf8") })
|
||||
}
|
||||
return scripts
|
||||
}
|
||||
|
||||
function randomId() {
|
||||
const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
|
||||
const bytes = new Uint8Array(32)
|
||||
crypto.getRandomValues(bytes)
|
||||
return Array.from(bytes, (value) => alphabet[value % alphabet.length]).join("")
|
||||
}
|
||||
@@ -212,7 +212,7 @@ export function uploadTestcases(file: File, options: { sql?: boolean } = {}) {
|
||||
if (options.sql) {
|
||||
form.append("sql", "1")
|
||||
}
|
||||
return http.post<TestcaseUploadedReturns>("admin/test_case", form, {
|
||||
return api2.post<TestcaseUploadedReturns>("admin/test-cases", form, {
|
||||
headers: { "content-type": "multipart/form-data" },
|
||||
})
|
||||
}
|
||||
|
||||
@@ -43,7 +43,7 @@ async function handleDeleteProblem() {
|
||||
}
|
||||
|
||||
function downloads() {
|
||||
download("test_case?problem_id=" + props.problemID)
|
||||
download(`problems/${props.problemID}/test-cases`)
|
||||
}
|
||||
|
||||
function goEdit() {
|
||||
|
||||
@@ -313,7 +313,7 @@ async function handleUploadTestcases({ file }: UploadCustomRequestOptions) {
|
||||
}
|
||||
|
||||
function downloadTestcases() {
|
||||
download("test_case?problem_id=" + problem.value.id)
|
||||
download(`problems/${problem.value.id}/test-cases`)
|
||||
}
|
||||
|
||||
// Mermaid 渲染事件处理
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
import axios from "axios"
|
||||
|
||||
// 指向新后端的 /api2/admin。响应是 zip 二进制，不走 { error, data } 信封，
|
||||
// 所以不能复用 utils/api2 的拦截器（它会把 response.data.data 取出来）。
|
||||
const http = axios.create({
|
||||
baseURL: "/api/admin",
|
||||
baseURL: "/api2/admin",
|
||||
responseType: "blob",
|
||||
xsrfHeaderName: "X-CSRFToken",
|
||||
xsrfCookieName: "csrftoken",
|
||||
withCredentials: true,
|
||||
})
|
||||
|
||||
async function download(url: string) {
|
||||
|
||||
Reference in New Issue
Block a user