docs(security): #155 重扫实测台账 + HTTP 层复验（open 归零） - #156
Merged
Merged
Conversation
重扫确认（run 35901422189 / headSha=d875c9c / success）： - py/path-injection 36 → 0（35 判 fixed + #14 按 mitigated 交差）； - py/stack-trace-exposure 7 判 fixed，但同位置重生 16 条新号 #114–#129 —— 其中 9 条就是 §7.1 那批已 dismiss 的 model.py 调用点，被我删函数的 行号推移顶了出来。逐条读过落点后全部按 mitigated 绑定 d875c9c 交差。 结论写进 §8.6：dismiss 绑的是告警号而不是代码事实，所以动这两族文件的重扫 成本是"再读一遍、再逐条交差一遍"。另记一次统计口径的坑： state=fixed 的 --paginate 在结果集变动时会重复返回记录，去重后是 total 128 = dismissed 76 + fixed 52 + open 0。 新增 tests/test_security_surface_http.py（10 条）经真实 ASGI 栈复验 #155 三处行为收紧。第一版漏了先 GET / 取 csrf_token，写请求全以 CSRF 403 结束、 5 条断言"全绿"却没打到业务分支 —— 加正向对照才暴露，这个反例一并写进注释。 本地：pytest 2124 passed / 12 skipped；ruff check/format 全绿。 Signed-off-by: ReSerendipity <ReSerendipity@users.noreply.github.com>
ReSerendipity
enabled auto-merge (squash)
September 23, 2026 18:34
ReSerendipity
added a commit
that referenced
this pull request
Sep 24, 2026
delete_branch_on_merge=false 是仓库级显式设置，删分支等于替维护者改掉这条策略， 所以 #155/#156 的两个分支留在 origin，以后默认保留、要删单独取授权。 resolve_persona_ref 与 voxcpm2 两条路由的音色解析仍空着：不为补测试自行 下载权重或加载引擎（3-4GB 与 GPU 都在红线上），这三格只能用户侧真机收口。 另记 A1-A16 的跟踪载体待定：pip-audit 无 expiration 机制、Dependabot 只覆盖 A1-A8，汇总 issue 草稿已交、批复前保持只有文档没有 issue。 Signed-off-by: ReSerendipity <ReSerendipity@users.noreply.github.com> Co-authored-by: ReSerendipity <ReSerendipity@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
这是什么
#155 合并后（main=d875c9c）跑了一次真重扫（run 35901422189，push 触发，success），把结果与逐条交差口径记进
docs/SECURITY_CODEQL_TRIAGE.md§8.6，并补一层此前没做过的 HTTP 验证。重扫实测
py/path-injectionmitigated交差（该函数在 #155 之前就是正确实现）py/stack-trace-exposuremitigated绑定d875c9c交差全仓 code-scanning 现状：total 128 = dismissed 76 + fixed 52 + open 0。
那 16 条新告警不是新问题：9 条就是 §7.1 那批早已 dismiss 的
model.py调用点，被我删函数的行号推移顶了出来；另外 7 条是 #155 刚改的settings.py×5 /persona.py/training.py。操作结论：dismiss 绑的是告警号而不是代码事实，所以以后动这两族文件，成本是"再读一遍、再逐条交差一遍"，不是"上次已完成"。顺带记一次自己踩到的统计口径坑：
state=fixed的--paginate在结果集同时变动时会重复返回记录，我一度读到 fixed=62；按number去重后是 52。报数前先去重。新增的 HTTP 层复验
tests/test_security_surface_http.py（10 条）经真实 ASGI 栈（CSRF 中间件 + 异常处理 + 路由匹配）复验 #155 的三处行为收紧：越界名不变 500、磁盘不留东西、失败响应不含服务端路径、拒绝文案仍带规则。写这个文件时踩到值得记的反例：第一版漏了先
GET /取csrf_tokenCookie，于是所有写请求以 CSRF 403 结束，5 条断言"全绿"却一条都没打到业务分支。加正向对照（合规但不存在的名字要回 400「不存在」）才暴露 —— 已把这个坑写进_csrf_headers的注释。仍未覆盖
resolve_persona_ref与 voxcpm2 设计/剧本工坊三条生成路由的音色解析，要真加载引擎才会走到（属 GPU + 人耳验收范围，按红线交回）。本地：
pytest -m "not gpu and not cuda and not integration and not benchmark and not e2e"→ 2124 passed / 12 skipped；ruff check/format 全绿；mypy 棘轮不涉及本 PR 文件。Refs: #155 #97 #99
CC @ReSerendipity