Guide to tracking a Xianyu seller's shop and prices with a scraper

·4 views

Xianyu, known in English as Goofish, is China's largest second-hand marketplace, where resellers and collectors often spot good deals early. Monitoring a busy seller by hand is difficult because the site is in Chinese, designed for the mobile app, and its inventory changes daily. The guide explains how to convert a seller's shop into a structured table and receive a daily list covering only new listings, price or title changes, and removed items. Scheduled runs with a named watch list return the full shop on the first pass and only changed rows afterward, with billing based on the number of rows stored. The scraper works from seller or item links rather than keyword search, since Xianyu limits search results to logged-in users.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Git's file transport should be restricted during recursive submodule fetches in CI

A Git superproject can define submodule URLs in its .gitmodules file, which Git may follow automatically during recursive clones or updates. Local file: URLs are a concern because they can reach the runner's filesystem, cached data, or other repositories present on the host. Such automatic fetches can run with the runner's local privileges, which can blur the separation between checking out the main project and fetching its dependencies. Git's protocol policy settings can restrict these transports, and the article recommends that the execution environment enforce them rather than relying on repository-local configuration. Teams should audit CI jobs that recurse submodules, pin expected submodule commits, and fail builds when submodule URLs change unexpectedly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Allowlisting git for AI agents can also enable code execution via config keys

Researchers at HiddenLayer showed that a compromised LLM gateway can inject a git command that begins with an approved prefix, so the agent runs it without prompting the user. The malicious command uses git's diff.external setting to pass .env contents through an external program. A separate Pillar Security disclosure found Codex CLI treated git show as safe, letting it write a diff.external entry into the repo config that later ran on git diff; OpenAI patched this in version 0.95.0. The article notes that approving a command prefix permits every configuration key that runs a program behind it, not just the intended read-only operations. Git's core.fsmonitor setting can similarly execute arbitrary commands during git status, which makes the risk broader than any single flag.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Missing Function Call Caused Recolouring Failure in a T-Shirt Design Lab

A developer running a small t-shirt design lab found two of their own artworks could not be recoloured and initially blamed the drawings themselves. One file had no fill colours at all, which displays differently across editors and browsers, and the other used two near-identical cream shades that caused the system to treat it as multicoloured. After fixing the duplicate colour, the problem persisted. Investigation revealed that the two upload routes handled colour normalisation differently. The admin library route skipped a necessary step, so some drawings were stored without the marker the editor needs to allow recolouring.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Autor cria bot pessoal no Telegram para resumos diários e lembretes sem SaaS

Um desenvolvedor relata ter montado um bot pessoal no Telegram que envia resumos matinais e lembretes pontuais, para reunir em um único canal informações espalhadas por diferentes apps. O processo começa com a criação do bot pelo BotFather, a obtenção do token e do chat_id, e um teste de envio via a API do Telegram. Como a Bot API não oferece agendamento nativo, o autor explica que o disparo das mensagens precisa ser controlado por um processo externo. Ele opta por um script em Python combinado com o cron do sistema, por ser leve e simples de depurar. A publicação enfatiza que a solução pode ser feita sem depender de serviços comerciais de terceiros.

0 comments Read more at DEV Community