Repository navigation
BossLock：1.4.5兼容修复 - #1212
Merged
ACaiCat merged 4 commits intoOct 31, 2026
Merged
BossLock：1.4.5兼容修复#1212
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
你好 - 我发现了 1 个安全问题
安全问题：
- 在 SQL 语句中检测到格式化字符串。如果未正确清理 SQL 语句中的变量，可能会导致 SQL 注入。请改用预处理语句。你可以使用“SqlCommand”和“SqlParameter”获取 PreparedStatement。（链接）
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/BossLock/Database.cs" line_range="146-147" />
<code_context>
command.CommandText = replaceAll ? "DELETE FROM boss_lock;"
: $"DELETE FROM boss_lock WHERE npc_id IN ({string.Join(',', rows.Keys.SelectMany(BossGroup.Members).Distinct())});";
</code_context>
<issue_to_address>
**security (csharp.lang.security.sqli.csharp-sqli):** Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.
*Source: opengrep*
</issue_to_address>Original comment in English
Hey - I've found 1 security issue
Security issues:
- Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/BossLock/Database.cs" line_range="146-147" />
<code_context>
command.CommandText = replaceAll ? "DELETE FROM boss_lock;"
: $"DELETE FROM boss_lock WHERE npc_id IN ({string.Join(',', rows.Keys.SelectMany(BossGroup.Members).Distinct())});";
</code_context>
<issue_to_address>
**security (csharp.lang.security.sqli.csharp-sqli):** Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.
*Source: opengrep*
</issue_to_address>
ACaiCat
requested changes
Oct 31, 2026
| // 配置别名不依赖服务器的显示语言；写回时统一保存数字 ID。 | ||
| public sealed class NpcIdConverter : JsonConverter<int> | ||
| { | ||
| private static readonly Dictionary<string, int> Names = new(StringComparer.OrdinalIgnoreCase) |
Contributor
There was a problem hiding this comment.
你好——我发现了 2 个问题
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/BossLock/NpcIdConverter.cs" line_range="50-52" />
<code_context>
+ public override int ReadJson(JsonReader reader, Type objectType, int existingValue,
+ bool hasExistingValue, JsonSerializer serializer)
+ {
+ if (reader.TokenType == JsonToken.Integer && reader.Value is long number &&
+ number >= 0 && number < NPCID.Count)
+ {
+ return (int)number;
+ }
</code_context>
<issue_to_address>
**Numeric NPC IDs are rejected**
When the JSON `NpcId` is an ordinary in-range integer token, `JsonTextReader` supplies ordinary in-range integer tokens as boxed `int` values, so the `reader.Value is long` check fails and `NpcIdConverter` throws; `Config.Read` then fails to load configurations that use numeric `NpcId` values, including existing configs.
Accept the integer representations returned by the JSON reader, or convert the token with a checked integer conversion.
</issue_to_address>
### Comment 2
<location path="src/BossLock/BossGroup.cs" line_range="22" />
<code_context>
+ [NPCID.Pumpking, NPCID.PumpkingBlade],
+ [NPCID.MartianSaucerCore, NPCID.MartianSaucer, NPCID.MartianSaucerTurret, NPCID.MartianSaucerCannon],
+ [NPCID.MoonLordCore, NPCID.MoonLordHead, NPCID.MoonLordHand, NPCID.MoonLordFreeEye],
+ [NPCID.CultistBoss, NPCID.CultistBossClone],
+ [NPCID.PirateShip, NPCID.PirateShipCannon]
+ ];
</code_context>
<issue_to_address>
**Moon Lord leech blobs bypass locks**
When a leech blob is spawned while the Moon Lord is configured as locked, `BossGroup.Root` leaves `MoonLordLeechBlob` ungrouped, so `SpawnGuard.IsBlocked` does not associate that Moon Lord component with a configured `MoonLordCore` lock and allows it to spawn. The component therefore escapes the group-wide lock and cleanup behavior.
Add `NPCID.MoonLordLeechBlob` to the Moon Lord group so lock checks and removal use the Moon Lord root.
</issue_to_address>Original comment in English
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/BossLock/NpcIdConverter.cs" line_range="50-52" />
<code_context>
+ public override int ReadJson(JsonReader reader, Type objectType, int existingValue,
+ bool hasExistingValue, JsonSerializer serializer)
+ {
+ if (reader.TokenType == JsonToken.Integer && reader.Value is long number &&
+ number >= 0 && number < NPCID.Count)
+ {
+ return (int)number;
+ }
</code_context>
<issue_to_address>
**Numeric NPC IDs are rejected**
When the JSON `NpcId` is an ordinary in-range integer token, `JsonTextReader` supplies ordinary in-range integer tokens as boxed `int` values, so the `reader.Value is long` check fails and `NpcIdConverter` throws; `Config.Read` then fails to load configurations that use numeric `NpcId` values, including existing configs.
Accept the integer representations returned by the JSON reader, or convert the token with a checked integer conversion.
</issue_to_address>
### Comment 2
<location path="src/BossLock/BossGroup.cs" line_range="22" />
<code_context>
+ [NPCID.Pumpking, NPCID.PumpkingBlade],
+ [NPCID.MartianSaucerCore, NPCID.MartianSaucer, NPCID.MartianSaucerTurret, NPCID.MartianSaucerCannon],
+ [NPCID.MoonLordCore, NPCID.MoonLordHead, NPCID.MoonLordHand, NPCID.MoonLordFreeEye],
+ [NPCID.CultistBoss, NPCID.CultistBossClone],
+ [NPCID.PirateShip, NPCID.PirateShipCannon]
+ ];
</code_context>
<issue_to_address>
**Moon Lord leech blobs bypass locks**
When a leech blob is spawned while the Moon Lord is configured as locked, `BossGroup.Root` leaves `MoonLordLeechBlob` ungrouped, so `SpawnGuard.IsBlocked` does not associate that Moon Lord component with a configured `MoonLordCore` lock and allows it to spawn. The component therefore escapes the group-wide lock and cleanup behavior.
Add `NPCID.MoonLordLeechBlob` to the Moon Lord group so lock checks and removal use the Moon Lord root.
</issue_to_address>…Moon Lord leeches
ACaiCat
enabled auto-merge
October 31, 2026 05:43
2 tasks done
ACaiCat
approved these changes
Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
修复多部位 Boss 的进度锁判定与生成拦截，关联 #1211。
/bl edit单独补齐；加载和重载不重置现有解锁时间。/bl reset先读取磁盘最新配置，再以事务替换记录；配置或写入异常时保留原记录。分组查询与删除均使用参数化 SQL。Sourcery 摘要
完善多部位首领的统一进度锁定与安全生成拦截，同时增强配置兼容性和进度数据保护。
新功能：
问题修复：
改进：
文档：
杂项：
Original summary in English
Sourcery 总结
强化多部件 Boss 和复合 Boss 的进度锁定机制，同时保留现有配置和解锁数据。
新功能：
错误修复：
改进：
文档：
杂项：
Original summary in English
Sourcery 总结
加强了多部分首领的进度锁定和召唤拦截，同时提升配置兼容性并保护现有进度数据。
新功能：
错误修复：
改进：
文档：
杂项：
Original summary in English
Sourcery 摘要
强化多部位与复合 Boss 的统一进度锁定和安全生成拦截，同时提升配置兼容性与进度数据保护。
新功能：
错误修复：
改进：
文档：
杂项：
Original summary in English
Summary by Sourcery
强化多部位与复合 Boss 的统一进度锁定和安全生成拦截，同时提升配置兼容性与进度数据保护。
New Features:
Bug Fixes:
Enhancements:
Documentation:
Chores: