chore: bump version to 1.4.3

[Johnson-zs]

1.4.3

Log:

Summary by Sourcery

Build:

• Update Debian packaging metadata to reflect version 1.4.3.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Johnson-zs

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

TAG Bot

TAG: 1.4.3
EXISTED: no
DISTRIBUTION: unstable

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Bumps the Debian package version to 1.4.3 in the changelog with no other code or config changes.

File-Level Changes

Change	Details	Files
Update Debian package metadata to version 1.4.3.	Increment the version number in the Debian changelog to 1.4.3 Add or adjust the corresponding changelog entry metadata for the new release	debian/changelog

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：40分

■ 【总体评价】

变更日志揭示了底层源码存在严重的路径遍历与并发竞态导致堆损坏问题
逻辑存在致命错误且包含多个高危安全漏洞，受安全上限规则强制限制得40分

■ 【详细分析】

• 1.语法逻辑（存在致命错误）✕

dfm-search模块中m_strategy成员变量在多线程环境下被并发读写，导致堆内存损坏。堆损坏属于底层的内存逻辑致命错误，会直接引发程序段错误或不可预期的行为崩溃。
潜在问题：多线程并发访问未受保护的非原子对象导致内存结构破坏；程序运行时随时可能因非法内存访问而终止。
建议：引入互斥锁对m_strategy的读写进行保护，或重构为线程局部存储及使用智能指针进行原子交换。

• 2.代码质量（存在严重问题）✕

DEnumerator::buildUrl函数在处理路径时缺乏严谨的协议边界划分，将适用于file协议的路径遍历检查逻辑错误地应用到了其他URL协议上，且检查模式过于宽泛导致误杀。
潜在问题：URL解析与校验逻辑职责混乱；正则匹配模式设计不精确，影响正常业务的合法路径解析。
建议：严格分离URL协议解析与路径校验逻辑，仅在确认scheme为file时执行文件系统级别的路径遍历检查。

• 3.代码性能（存在严重性能问题）✕

m_strategy引发的堆损坏可能导致内存管理器数据结构破坏，进而引发死锁或无限循环等极端性能退化问题；不精确的宽泛路径遍历正则匹配也会在处理大量非文件URL时产生不必要的CPU开销。
潜在问题：内存损坏引发的连锁反应导致系统资源死锁；低效的全局正则匹配增加延迟。
建议：消除竞态以避免堆损坏带来的不可控性能损耗；将路径遍历检查前置于协议判断分支中，避免无效匹配。

• 4.代码安全（存在 2 个安全漏洞）✕

漏洞对比统计：新增漏洞 2 个，减少漏洞 0 个，持平 0 个
代码在URL处理和并发控制上存在严重缺陷，攻击面覆盖本地文件系统越权读取及进程拒绝服务

• 安全漏洞1（【高危】）：路径遍历 在 DEnumerator::buildUrl 中，函数未限制URL Scheme便执行路径遍历检查，且匹配模式过宽，可能被攻击者利用构造特殊的非file协议URL绕过检查，或在file协议下通过../序列实现目录穿越，读取系统敏感文件 ——非常重要

• 安全漏洞2（【高危】）：跨线程竞态条件导致堆损坏 在 dfm-search模块的m_strategy 中，该成员变量在多线程环境下缺乏同步机制保护，攻击者可通过触发特定的搜索任务并发场景，利用竞态条件破坏堆内存结构，导致程序崩溃或潜在的代码执行 ——非常重要

• 建议：在DEnumerator::buildUrl入口处增加对QUrl::scheme()的严格判定，仅当scheme等于"file"时才调用路径规范化与遍历检查函数，并收紧正则表达式；为dfm-search中的m_strategy增加QMutex或std::mutex保护，确保多线程读写时的内存一致性。

■ 【改进建议代码示例】

#include <QUrl>
#include <QRegularExpression>
#include <QMutex>
#include <QMutexLocker>
#include <memory>

// 修复1：DEnumerator::buildUrl 中的路径遍历检查限制
QUrl DEnumerator::buildUrl(const QUrl &inputUrl) {
    QUrl url = inputUrl;
    
    // 严格限制路径遍历检查仅针对 file scheme
    if (url.scheme() == "file") {
        QString path = url.toLocalFile();
        
        // 收窄路径遍历检查模式，精确匹配恶意的 ../ 或 ..\ 序列
        QRegularExpression traversalPattern("(^|/|\\\\)\\.\\.(/|\\\\|$)");
        if (path.contains(traversalPattern)) {
            // 拒绝包含路径遍历的请求
            return QUrl();
        }
        
        // 合法化路径后重新构建 URL
        url = QUrl::fromLocalFile(path);
    }
    // 其他 scheme 直接放行，不进行文件系统级别的路径遍历拦截
    
    return url;
}

// 修复2：消除 dfm-search 中 m_strategy 的跨线程竞态
class SearchStrategy {
public:
    virtual ~SearchStrategy() = default;
    virtual void execute() = 0;
};

class DfmSearchWorker : public QObject {
    Q_OBJECT
public:
    void setStrategy(std::shared_ptr<SearchStrategy> strategy) {
        QMutexLocker locker(&m_mutex);
        m_strategy = strategy;
    }

    void doSearch() {
        std::shared_ptr<SearchStrategy> currentStrategy;
        {
            // 在锁的保护下获取当前策略的拷贝，避免在执行时持有锁或访问被破坏的内存
            QMutexLocker locker(&m_mutex);
            currentStrategy = m_strategy;
        }

        if (currentStrategy) {
            // 安全地在多线程环境中使用策略对象
            currentStrategy->execute();
        }
    }

private:
    std::shared_ptr<SearchStrategy> m_strategy;
    QMutex m_mutex; // 引入互斥锁保护 m_strategy 的并发访问
};

[deepin-ci-robot]

@Johnson-zs: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
github-pr-review-ci	e77a81f	link	true	/test github-pr-review-ci

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[Johnson-zs]

/forcemerge

[deepin-bot]

This pr force merged! (status: blocked)

[deepin-bot]

TAG Bot

✅ Tag created successfully

📋 Tag Details

• Tag Name: 1.4.3
• Tag SHA: a4307d3d60bd28c05a337aa3997026f9c2a10d7d
• Commit SHA: 47839a844053dcab0b5997f4e01d843ae465f9b0
• Tag Message:

  Release util-dfm 1.4.3
  
  

• Tagger:
  • Name: Johnson-zs
• Distribution: unstable

[Zeno-sole]

/topic dfm-20260806

[deepin-ci-robot]

Add topic: dfm-20260806 successed.

[Zeno-sole]

/integr-topic dfm-20260806

[deepin-ci-robot]

Integrated with pr deepin-community/Repository-Integration#4461