From a00cdb5baab16934e9667f70fa75568d30349825 Mon Sep 17 00:00:00 2001 From: OpenClaw Bot Date: Wed, 18 Mar 2026 04:02:36 +0800 Subject: [PATCH 1/2] fix: unify log timestamp format in xfyun ASR extensions - Consistent timestamp format %Y-%m-%d %H:%M:%S.%f (with milliseconds) - Fixed 3 files: xfyun_asr_python, xfyun_asr_bigmodel_python, xfyun_asr_dialect_python - Resolves issue #2082 --- .../extension/xfyun_asr_bigmodel_python/recognition.py | 5 ++--- .../extension/xfyun_asr_dialect_python/recognition.py | 3 ++- .../ten_packages/extension/xfyun_asr_python/recognition.py | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/ai_agents/agents/ten_packages/extension/xfyun_asr_bigmodel_python/recognition.py b/ai_agents/agents/ten_packages/extension/xfyun_asr_bigmodel_python/recognition.py index 9ba833909f..64dbb8e6cb 100644 --- a/ai_agents/agents/ten_packages/extension/xfyun_asr_bigmodel_python/recognition.py +++ b/ai_agents/agents/ten_packages/extension/xfyun_asr_bigmodel_python/recognition.py @@ -217,9 +217,8 @@ async def _handle_message(self, message): except Exception as e: error_msg = f"Error processing message: {e}" - self._log_debug( - f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}] {error_msg}" - ) + timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3] + self._log_debug(f"[{timestamp}] {error_msg}") if self.callback: await self.callback.on_error(error_msg) diff --git a/ai_agents/agents/ten_packages/extension/xfyun_asr_dialect_python/recognition.py b/ai_agents/agents/ten_packages/extension/xfyun_asr_dialect_python/recognition.py index 6c06186e44..99ae1fe2d0 100644 --- a/ai_agents/agents/ten_packages/extension/xfyun_asr_dialect_python/recognition.py +++ b/ai_agents/agents/ten_packages/extension/xfyun_asr_dialect_python/recognition.py @@ -252,8 +252,9 @@ async def _handle_message(self, message): except Exception as e: error_msg = f"Error processing message: {e}" + timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3] self.ten_env.log_error( - f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}] {error_msg}" + f"[{timestamp}] {error_msg}" ) if self.callback: await self.callback.on_error(error_msg) diff --git a/ai_agents/agents/ten_packages/extension/xfyun_asr_python/recognition.py b/ai_agents/agents/ten_packages/extension/xfyun_asr_python/recognition.py index 329e9071b0..2010486c10 100644 --- a/ai_agents/agents/ten_packages/extension/xfyun_asr_python/recognition.py +++ b/ai_agents/agents/ten_packages/extension/xfyun_asr_python/recognition.py @@ -197,8 +197,9 @@ async def _handle_message(self, message): except Exception as e: error_msg = f"Error processing message: {e}" + timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3] self.ten_env.log_info( - f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}] {error_msg}" + f"[{timestamp}] {error_msg}" ) await self.callback.on_error(error_msg) From 7ab1b6807f6567486d69cae686c8586b09288ea4 Mon Sep 17 00:00:00 2001 From: Jah-yee Date: Wed, 18 Mar 2026 08:55:00 +0800 Subject: [PATCH 2/2] fix: replace shell=True with shell=False in subprocess.run Security fix for issues #2107 and #2106 - Use shlex.split() to safely parse command string - Pass shell=False to prevent shell injection vulnerabilities --- .../ten_packages/extension/main_nodejs/tools/run_script.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ai_agents/agents/examples/voice-assistant-nodejs/tenapp/ten_packages/extension/main_nodejs/tools/run_script.py b/ai_agents/agents/examples/voice-assistant-nodejs/tenapp/ten_packages/extension/main_nodejs/tools/run_script.py index 616bc1b093..728c1b1599 100644 --- a/ai_agents/agents/examples/voice-assistant-nodejs/tenapp/ten_packages/extension/main_nodejs/tools/run_script.py +++ b/ai_agents/agents/examples/voice-assistant-nodejs/tenapp/ten_packages/extension/main_nodejs/tools/run_script.py @@ -5,6 +5,7 @@ # See the LICENSE file for more information. # import argparse +import shlex import subprocess import sys import os @@ -15,7 +16,7 @@ def run_cmd(cmd: str, env: dict[str, str] | None = None) -> int: if env is None: env = os.environ.copy() print(f"Running: {cmd}") - result = subprocess.run(cmd, shell=True, check=True, env=env) + result = subprocess.run(shlex.split(cmd), shell=False, check=True, env=env) return result.returncode