docs(security): 分诊表刷新到 56 条现状 + 逐条判定台账 + tracker 反向链接 - #154
Merged
Merged
Conversation
新增 §7（现状以该节为准，§6 是 09-21 快照）： - 本批 dismiss 16 条（routes/model.py 的 11 条 stack-trace 按 #96 绑 mitigated； 3 条 blob:/textContent 判误报；tabs.py 相对重定向 1 条；voxcpm2/design.py 去标签 属规则误用 1 条），每条在 CodeQL 上写了 280 字符内的绑定理由。open 76 → 56（实测分布 36 path-injection + 18 stack-trace + 2 reflective-xss，后者等 #153 合并消解）。 - 剩余 40 条逐条给判定：19 条已缓解可下批收口；17 条 path-injection 无强校验 （generation 3 / persona_metadata 6 / resolve_persona_ref 2 / voxcpm2 design+script 6）； stack-trace 里确认 5 处 settings.py 把 str(exc) 原文放进响应，13 处待读。 - 写明一条口径：html.escape 只防 XSS，不防信息泄露，stack-trace 这族不能拿它交差。 - §7.3 衔接 issue #97（锁集已按"退"路自洽，但 4.52.x 的 16 条公告代价未见 pip-audit 命中/豁免说明）与 #99（3 处真 XSS 的 incomplete-sanitization 整族已归零，修法未复核）。 - SECURITY_REMEDIATION_TRACKER.md 补指向本表的反向链接（此前该链接依赖已关闭的 #81）。 Signed-off-by: ReSerendipity <zengyangc@outlook.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
纯文档（2 个 md 文件），无代码改动。现状数字实测：open 分布
36 py/path-injection + 18 py/stack-trace-exposure + 2 py/reflective-xss = 56。html.escape只防 XSS，不防信息泄露，py/stack-trace-exposure这族不能拿它交差。SECURITY_REMEDIATION_TRACKER.md补指向分诊表的反向链接（此前该链接计划挂在 feat(ci)+fix(security): 钉版下界棘轮门禁 + CSRF 静默降级改硬失败 #81 上，而 feat(ci)+fix(security): 钉版下界棘轮门禁 + CSRF 静默降级改硬失败 #81 已 closed 未合）。未做的事（明确留给下一阶段）
generation.py3 /persona_metadata.py6 /resolve_persona_ref2 /voxcpm2design+script 6）与 5 条settings.py把str(exc)放进响应 —— 本阶段按指示不改代码，只给判定。建议统一复用persona_manager的白名单 + realpath 前缀，而不是每处再写一遍basename()。