分类 code 下的文章

ShopXO v6.3.0 导致 服务器 Webshell 恶意文件安全事件排查与修复全记录

告警时间：2026-08-16 下午（GMT+8）
服务器环境：腾讯云轻量服务器 | OpenCloudOS | 宝塔面板 | Nginx + PHP 8.2.x + ThinkPHP 8.0.x + ShopXO v6.3.0（已应用本次安全修复）

说明：本文已脱敏，域名、公网 IP、服务器实例 ID 等均以占位符或泛化描述代替。

- 阅读剩余部分 -

Claude Code 第三方 API 环境下 WebFetch 失效的完整解决方案

问题描述

在使用 Claude Code 的过程中，如果你通过第三方 API（如阿里云 DashScope、DeepSeek、智谱 GLM 等国内大模型平台）接入而非 Anthropic 官方 API，你很可能会遇到以下两种 WebFetch 故障之一：

故障一：安全预检失败

Fetch(https://huggingface.co/microsoft/VibeVoice-Realtime-0.5B)
  Error: Unable to verify if domain xxx is safe to fetch. 
  This may be due to network restrictions or enterprise security policies blocking claude.ai.

故障二：抓取成功但不返回结果

Fetch(https://example.com/article)
  Received 53.3KB (200 OK)

Bash(curl -s "https://example.com/article" -H "User-Agent: ...")
  ...（Claude Code 默默回退到 curl 获取原始 HTML）

Claude Code 会自行降级到 curl + grep 的方式提取网页文本，虽然勉强能用，但丧失了对网页内容的结构化理解和摘要能力。

- 阅读剩余部分 -

ChatGPT的api可以输出json格式，但是无法指定key的名称，类型也不可控，所以去爬了langchain输出结构化结果的提示词，亲测GPT3.5也能完美输出。
注意提示词要用英文！
最后输出的结果需要处理一下markdown的标签。

为保证结果可用，写了一个循环提取json，如果无法提取，重新生成结果重试。

# flake8: noqa

STRUCTURED_FORMAT_INSTRUCTIONS = """The output should be a markdown code snippet formatted in the following schema, including the leading and trailing "```json" and "```":

```json
{{
{format}
}}
```"""

STRUCTURED_FORMAT_SIMPLE_INSTRUCTIONS = """
```json
{{
{format}
}}
```"""


PYDANTIC_FORMAT_INSTRUCTIONS = """The output should be formatted as a JSON instance that conforms to the JSON schema below.

As an example, for the schema {{"properties": {{"foo": {{"title": "Foo", "description": "a list of strings", "type": "array", "items": {{"type": "string"}}}}}}, "required": ["foo"]}}
the object {{"foo": ["bar", "baz"]}} is a well-formatted instance of the schema. The object {{"properties": {{"foo": ["bar", "baz"]}}}} is not well-formatted.

Here is the output schema:
```
{schema}
```"""

YAML_FORMAT_INSTRUCTIONS = """The output should be formatted as a YAML instance that conforms to the given JSON schema below.

# Examples
## Schema
```
{{"title": "Players", "description": "A list of players", "type": "array", "items": {{"$ref": "#/definitions/Player"}}, "definitions": {{"Player": {{"title": "Player", "type": "object", "properties": {{"name": {{"title": "Name", "description": "Player name", "type": "string"}}, "avg": {{"title": "Avg", "description": "Batting average", "type": "number"}}}}, "required": ["name", "avg"]}}}}}}
```
## Well formatted instance
```
- name: John Doe
  avg: 0.3
- name: Jane Maxfield
  avg: 1.4
```

## Schema
```
{{"properties": {{"habit": {{ "description": "A common daily habit", "type": "string" }}, "sustainable_alternative": {{ "description": "An environmentally friendly alternative to the habit", "type": "string"}}}}, "required": ["habit", "sustainable_alternative"]}}
```
## Well formatted instance
```
habit: Using disposable water bottles for daily hydration.
sustainable_alternative: Switch to a reusable water bottle to reduce plastic waste and decrease your environmental footprint.
``` 

Please follow the standard YAML formatting conventions with an indent of 2 spaces and make sure that the data types adhere strictly to the following JSON schema: 
```
{schema}
```

Make sure to always enclose the YAML output in triple backticks (```). Please do not add anything other than valid YAML output!"""


PANDAS_DATAFRAME_FORMAT_INSTRUCTIONS = """The output should be formatted as a string as the operation, followed by a colon, followed by the column or row to be queried on, followed by optional array parameters.
1. The column names are limited to the possible columns below.
2. Arrays must either be a comma-separated list of numbers formatted as [1,3,5], or it must be in range of numbers formatted as [0..4].
3. Remember that arrays are optional and not necessarily required.
4. If the column is not in the possible columns or the operation is not a valid Pandas DataFrame operation, return why it is invalid as a sentence starting with either "Invalid column" or "Invalid operation".

As an example, for the formats:
1. String "column:num_legs" is a well-formatted instance which gets the column num_legs, where num_legs is a possible column.
2. String "row:1" is a well-formatted instance which gets row 1.
3. String "column:num_legs[1,2]" is a well-formatted instance which gets the column num_legs for rows 1 and 2, where num_legs is a possible column.
4. String "row:1[num_legs]" is a well-formatted instance which gets row 1, but for just column num_legs, where num_legs is a possible column.
5. String "mean:num_legs[1..3]" is a well-formatted instance which takes the mean of num_legs from rows 1 to 3, where num_legs is a possible column and mean is a valid Pandas DataFrame operation.
6. String "do_something:num_legs" is a badly-formatted instance, where do_something is not a valid Pandas DataFrame operation.
7. String "mean:invalid_col" is a badly-formatted instance, where invalid_col is not a possible column.

Here are the possible columns:
```
{columns}
```
"""

安装问题

1. pro create myapp 新建项目时 报错:

Error: Command failed with exit code 128: git clone https://gitee.com/ant-design/ant-design-pro --depth=1 --branch all-blocks myapp

原因是git命令的代理问题，使用命令没有解决，直接打开git的配置文件删除proxy就解决了。

- 阅读剩余部分 -

  1. 1
  2. 2