黑客滥用 GitHub 评论地址传播恶意程序
恶意攻击者滥用了 GitHub 的一个缺陷或设计决策，当用户在软件包库发表评论上传文件时它会自动生成一个关联网址，即使评论最后并没有发布。当用户看到来自微软库的文件网址时可能会认为是可信网址。
举例来说， 这两个文件都不属于 vcpkg 和 STL 库，而是作为用户评论的一部分上传的。 ``` https://github[.]com/microsoft/vcpkg/files/14125503/Cheat.Lab.2.7.2.zip
https://github[.]com/microsoft/STL/files/14432565/Cheater.Pro.1.6.0.zip ```
lemmy上传头像时，左下角出现如下报错
报错信息
浏览器报错信息
{"data":{"error":"unknown","message":"error decoding response body: EOF while parsing a value at line 1 column 0"},"state":"success"}
Response status code: 400
问题原因
通过报错信息推测是网络问题，排查docker-compose配置发现，前几天加了一行http proxy代理测试配置，移除代理后图片上传正常。
解决方法
简单解决：修复网络
如果上游有网络代理，修复网络连接即可。
完美解决：优化网络代理配置
网络代理可以隐藏服务器的真实请求IP，在不缺失代理的前提下，可以通过no_proxy排除掉本地受影响服务。
最终通过docker-compoe.yml配置网络代理配置如下：
environment:
- http_proxy=192.168.x.x:xxxx
- no_proxy="lemmy,localhost,127.0.0.1,postgres,pictrs,0.0.0.0"
Troubleshooting Lemmy: How to Fix Image/Avatar Upload Issues and Configure Network Proxies
> When uploading an avatar in Lemmy, the following error appears in the bottom left corner:
Error Message
Browser error message:
{"data":{"error":"unknown","message":"error decoding response body: EOF while parsing a value at line 1 column 0"},"state":"success"}
Response status code: 400
Cause of the Problem
Based on the error message, it is speculated to be a network issue. Upon inspecting the docker-compose configuration, a http proxy testing configuration added a few days ago was discovered. After removing the proxy, the image upload worked normally.
Solutions
Quick Fix: Repair the Network
If there is a network proxy, simply repairing the network connection should resolve the issue.
Perfect Solution: Optimize Network Proxy Configuration
A network proxy can hide the real request IP of the server. Without losing the proxy, local services affected can be excluded using no_proxy.
The final network proxy configuration in docker-compose.yml is as follows:
environment: - http_proxy=192.168.x.x:xxxx - no_proxy="lemmy,localhost,127.0.0.1,postgres,pictrs,0.0.0.0"
建站2周，记录下自建lemmy以来遇到的问题
- lemmy docker部署的文档不够完善，没有官方打包好的image
- 管理员面板功能太少
- 注册填写错邮箱后，没有一个友好的重发按钮，只能操作数据库解决
- 暂时还没有一个中文lemmy大站
还有很多问题，想起来再记录~