@feng0531/dsh-code-review 0.23.0 → 0.23.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # 变更记录
 
+## 0.23.1
+
+- 模板/IaC/协议schema按已捕获路径附缺陷检查：实际上下文转义、权限/破坏性资源变化、wire/client兼容/授权迁移风险。
+- 指引不证明执行/应用/约束，不增加读取/调用，不加风格审核；256测试通过。
+
 ## 0.23.0
 
 - 补Java/Go/Python/Rust/Kotlin/PHP缺陷检查及依赖清单/GitHub Actions专用风险指引；仅已捕获路径选择，不新读取/调用，不风格审核。

package/README.md

@@ -4,7 +4,7 @@
 
 ## 当前状态
 
-当前代码版本为 0.23.0
+当前代码版本为 0.23.1
 
 单提交审查直接读取原始commit头的父节点，不受浅克隆遍历边界影响；缺失父树明确失败且不自动fetch，不能把非根提交当空旧侧。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -17,6 +17,8 @@ export function defectGuidance(filePath) {
  const specialized = /\.java$/.test(lower) ? 'java' : /\.go$/.test(lower) ? 'go' : /\.(py|pyi)$/.test(lower) ? 'python' : /\.rs$/.test(lower) ? 'rust' : /\.(kt|kts)$/.test(lower) ? 'kotlin' : /\.(php|phtml)$/.test(lower) ? 'php' : null;
  const language = specialized ?? (/\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic');
  const fileType = /^\.github\/workflows\/.+\.(yaml|yml)$/.test(lower) ? 'github-workflow' : /(?:^|\/)(package\.json|cargo\.toml|pom\.xml|build\.gradle|composer\.json)$/.test(lower) ? 'dependency-manifest' : undefined;
+ const purpose = fileType ?? (/\.(ftl|ftlh|ftlx|hbs|mustache|jinja2|j2|pug|astro)$/.test(lower) ? 'template' : /\.(tf|hcl|tfvars|bicep|nix)$/.test(lower) ? 'infrastructure' : /\.(proto|thrift|capnp|graphql|gql|prisma)$/.test(lower) ? 'protocol-schema' : undefined);
+ const purposeChecks = purpose === 'template' ? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.'] : purpose === 'infrastructure' ? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.'] : purpose === 'protocol-schema' ? ['Check field identifier reuse, removed/renamed fields, type/nullability/default changes and wire/client compatibility against actual consumers.', 'Check resolver authorization, data exposure, migration constraints and referential integrity using captured implementation evidence; schema alone does not prove enforcement.'] : [];
  const typeChecks = fileType === 'github-workflow' ? ['Check event trust boundaries, token permissions and fork/PR-controlled inputs before privileged commands or secret exposure.', 'Check expression interpolation into shell commands, checkout/ref provenance, artifact/cache trust and required job dependency gates.'] : fileType === 'dependency-manifest' ? ['Check changed dependency versions/features against consumers, lock/resolution evidence and runtime compatibility; do not invent a vulnerability from a package name.', 'Check executable install/build hooks, publish/export entry points and platform constraints for concrete changed behavior.'] : [];
- return { version:2, language, ...(fileType ? {fileType} : {}), checks:[...common,...(checklists[language] ?? []),...typeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
+ return { version:3, language, ...(purpose ? {fileType:purpose} : {}), checks:[...common,...(checklists[language] ?? []),...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
 }