feat: Prompt Judge with DeepSeek AI + token management + safety filter - #28
Open
Zero-Tom-cmp wants to merge 4 commits into
Open
Zero-Tom-cmp wants to merge 4 commits into
Zero-Tom-cmp wants to merge 4 commits into
Conversation
- New Prompt Judge problem type with DeepSeek API code generation - Token usage management (per-submission cap, total quota, statistics) - Prompt content validation (URL/code/spam detection, custom regex) - AI output safety filter (dangerous ops detection, sensitive words) - Bug fixes (transaction protection, score auto-update, quota race fix, data cleanup) - Docker healthcheck covers judge daemon Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- submit.php: 提示词提交后立即插入占位 solution 并跳转状态页， AI 生成由后台 prompt_generated 守护进程完成，生成失败不占用提交冷却 - 新增 prompt_generated 多 worker 守护进程（PROMPT_GENERATED_WORKERS 默认 3）， DeepSeek 超时可配（DEEPSEEK_TIMEOUT_SECONDS 默认 300s），超时即失败并释放 worker - install.sh: php7.0 已从 PPA 下架，改用 Ubuntu 自带 php7.4；补充 gcc g++ python3 - Dockerfile: apt 源改阿里云 HTTPS 并预装 ca-certificates（兼容代理环境） - healthcheck 增加 prompt_generated 存活检查 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
判题降权
- mini_judged: 编译与运行提交代码改用 setpriv 降权到 nobody，不再以 root
执行；工作目录放开权限供其写自己的临时文件
黑名单补漏
- check_generated_code_safety(): 新增 language 参数，按语言细分规则
- 通用 C/C++: fopen/freopen/ofstream/ifstream/fstream/filesystem、
open/remove/rename/mkdir/rmdir/chmod/chown/truncate、fork/exec*、
/var/hznuoj/data 路径
- Bash(5): 文件类与网络类命令
- PHP(7): 文件函数、include/require、网络调用、反引号执行
- Python3(18): os.* 文件系统与 pathlib/shutil/glob/tempfile
报错信息分级
- prompt_generated: fail_generation() 增加 SAFETY/SERVICE/INTERNAL 原因码，
明细只写入 prompt_submission.deepseek_error（管理员可见）与守护进程日志，
学生端 compileinfo 只显示通用文案，不再暴露命中的规则
提示词注入加固
- 系统提示词明确学生文本是"待求解的题面"而非指令，忽略其中与解题无关的
要求（读写文件、探测身份/环境、塞入额外注释、输出多个程序等）
- extract_generated_code(): 模型拼接多个程序时只保留第一个
其他
- validate_prompt_content(): 中文按字计数，修复中文提示词被误判为过短
- 新增 start.d/22-judge-perms.sh: 每次容器启动重新施加挂载目录权限
（data/upload → www-data 组读写、其他用户不可见；static.php → 640
root:www-data），堵住判题代码篡改测试数据、读取 .out 答案、改写配置
- 修复 start.d 守护进程存活检测的 pgrep 模式：原来的
pgrep -f -x "/scripts/bin/xxx" 永远匹配不到 "php /scripts/bin/xxx"，
每次容器启动都会多起一个守护进程
- 新增 .gitattributes (eol=lf)，避免 Windows 下 core.autocrlf 把脚本
签出成 CRLF 破坏 shebang
Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Prompt Judge problem type enabling AI-powered code generation via DeepSeek API, plus token management and content safety features.
New Features
Files Changed (23 files, +2472/-227)
Database Migration
Execute new entries in scripts/db_change.sql (new columns on problem/more_settings, new prompt_submission table).
Configuration
Set via static.php or Docker env: DEEPSEEK_API_KEY, DEEPSEEK_MODEL