@feng0531/dsh-code-review 0.54.0 → 0.55.0

package/CHANGELOG.md

@@ -2,9 +2,13 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.55.0 — 模板引擎与基础设施即代码专用指导
+
+为 Freemarker、Handlebars/Mustache、Jinja、Pug、Astro 等模板引擎补充转义边界、模板注入、缺失值与部分/继承的保守缺陷提示；为 Terraform、Bicep 补充硬编码凭据、过度授权访问、状态/生命周期与版本可复现的保守缺陷提示。按具体引擎后缀选择，仍为证据门控提示，不是语义解析或渲染执行结果。只读批准快照，不改变审查行为或参数。
+
 ## 0.54.0 — 对齐结论与边界收尾
 
-合并保守语法范围内的对齐结论，明确剩余仅继承/原型链/动态分派（需语义解析器）、SVN 历史区间（设计不支持）、引擎版本（保持通用）与后置真实模型质量评测。不改变审查行为或参数。
+合并保守语法范围内的对齐结论，明确剩余仅继承/原型链/动态分派（需语义解析器）、SVN 历史区间（设计不支持）、引擎版本（保持通用）与后置真实模型质量评测。不改变审查行为或参数。443 项完整回归、实际宿主与四组 CI 通过；npm、Release 与原产物 104,761 字节一致，双哈希、清单与发布说明通过。
 
 ## 0.53.0 — 分组×验证×检索的组合验收
 

package/CORE-ALIGNMENT-TASKS.md

@@ -25,7 +25,7 @@
 
 - 继承、原型链与动态分派：需要语言解析器或类型检查器做语义绑定，超出「只读批准快照、不放宽预算」的保守边界。
 - SVN 历史区间等旧侧独有来源：历史/旧侧三层链、oldContextPaths、删除旧正文复用已交付；SVN 历史区间按设计不支持。
-- 模板与依赖清单引擎版本：按「不按文件名推定行为」保持通用提示。
+- 依赖清单与配置类引擎版本：按「不按文件名推定行为」保持通用提示。
 - 真实模型质量评测：目标明确后置，保存真实输出、人工裁决、分开统计，不作为对齐前提。
 
 各版交付结论见「当前验证结论」与 [版本变化](CHANGELOG.md)。
@@ -33,6 +33,7 @@
 ## 当前验证结论
 
 - 最近完整回归：443 项通过。
+- v0.54.0 已正式交付对齐结论与边界收尾。443 项回归、实际宿主与四组 CI 通过；npm、Release 与原包 104,761 字节一致，SHA-256、SHA-512、清单与发布说明核验通过；不改变审查行为或参数。
 - v0.53.0 已正式交付分组×验证×检索的组合验收。443 项回归、实际宿主、13 项独立安装专项与四组 CI 通过；npm、Release 与原包 104,757 字节一致，双哈希与清单核验通过；不改变审查行为或参数。
 - v0.52.1 已正式交付保守类实例方法导航。442 项回归、实际宿主、24 项独立安装专项和四组 CI 通过；npm、Release 与原包 104,817 字节一致，SHA-256、SHA-512 与清单核验通过。v0.52.0 复核发现接收者逃逸、静态修饰符与字段初始化器幻影方法误判且未参与预算省略，由 0.52.1 替代，未发布不计作交付。
 - v0.51.0 已正式交付多轮×窗口×检索×预算的组合验收。432 项回归、实际宿主、12 项独立安装专项与四组 CI 通过；npm、Release 与原包 102,433 字节一致，双哈希与清单核验通过；不改变审查行为或参数。

package/CORE-SOURCE-INVENTORY.md

@@ -38,7 +38,7 @@
 - PO/POT、MyBatis 映射：文本身份、复数、占位符、绑定值与动态 SQL 提示。
 - JS/TS/React：hook、异步清理与渲染副作用提示。
 
-Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示、Objective-C/Swift/Kotlin/Java/C/C++ 的生命周期与并发细化提示也已交付。以下仍以通用指导为主：模板、依赖清单与基础设施的引擎版本和消费者约束，按“不按文件名推定行为”保留通用提示。全部提示不是语义解析、迁移执行结果或缺陷证据。
+Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示、Objective-C/Swift/Kotlin/Java/C/C++ 的生命周期与并发细化提示也已交付；模板引擎（Freemarker、Handlebars/Mustache、Jinja、Pug、Astro）与基础设施即代码（Terraform、Bicep）的转义边界、模板注入、硬编码凭据与生命周期保守提示也已交付。以下仍以通用指导为主：依赖清单与配置（Cargo.toml、composer.json、package.json、pom.xml、build.gradle、GitHub 工作流、yaml、properties、json）的引擎版本和消费者约束，按“不按文件名推定行为”保留通用提示。全部提示不是语义解析、迁移执行结果或缺陷证据。
 
 ## 固定参考文件索引
 

package/RELEASE-NOTES.md

@@ -1,12 +1,12 @@
-# v0.54.0 发布说明
+# v0.55.0 发布说明
 
-## 对齐结论与边界收尾
+## 模板引擎与基础设施即代码专用指导
 
-本轮合并保守语法范围内的对齐结论：核心代码审查能力（变更采集、范围保护、审查流程、检索、调用方与定义导航、历史同版本上下文、语言与协议提示、组合验收）均已正式交付。剩余项明确记录为超出保守边界或由目标后置：继承/原型链/动态分派需语义解析器、SVN 历史区间按设计不支持、模板与依赖清单引擎版本保持通用、真实模型质量评测后置。
+本轮把此前对模板与基础设施文件的通用提示细化为按引擎的保守缺陷指导：Freemarker、Handlebars/Mustache、Jinja、Pug、Astro 关注转义边界、模板注入、缺失值与部分/继承；Terraform、Bicep 关注硬编码凭据、过度授权、状态/生命周期与版本可复现。全部提示只针对具体缺陷和反证，不照搬风格偏好或性能建议，也不新增读取或放宽预算。
 
 ## 限制
 
 - 只读批准快照，不新增读取、不放宽预算、不改变审查行为或参数。
-- 不使用版本或测试数量表示对齐百分比。
+- 依赖清单与配置类文件（Cargo.toml、composer.json、package.json、pom.xml、build.gradle、GitHub 工作流、yaml、properties、json）仍保持通用提示，按“不按文件名推定行为”处理。
 
-使用方法见 [README](README.md)。
+使用方法见 [README](README.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -33,7 +33,14 @@ const checklists = {
  ocaml: ['Check option/result/exception paths, tail-recursion assumptions, physical versus structural equality and resource cleanup.', 'Check GADT/exhaustiveness and FFI lifetime; do not invent a module signature that is not captured.'],
  po: ['Check msgid/msgstr identity, plural-forms rules, format specifiers and their order, and encoding/NFC identity.', 'Check untranslated/fuzzy markers and placeholder mismatch against the actual extraction catalog.'],
  mybatis: ['Check parameter bound type, #{} versus ${}, collection iteration and NULL semantics in dynamic SQL against the mapper interface.', 'Check result map column/type, statement id uniqueness and cache invalidation; do not infer database behavior that is not captured.'],
- react: ['Check effect cleanup, stale closures over dependencies, and async setState after unmount or on cancelled requests.', 'Check list keys, event-handler reuse and render-phase side effects; do not classify a memo re-render as a defect without evidence.']
+ react: ['Check effect cleanup, stale closures over dependencies, and async setState after unmount or on cancelled requests.', 'Check list keys, event-handler reuse and render-phase side effects; do not classify a memo re-render as a defect without evidence.'],
+  freemarker: ['Check ${...} reaching HTML without auto-escaping or the matching ?html/?url/?js_string builtin, and flag ?no_esc/<#noautoesc> as an escape hatch on user-controlled values; do not report missing escaping when <#ftl output_format> or .ftlh/.ftlx auto-activates it.', 'Check template source, names or bodies derived from request input (<#include>, <#import>, get_optional_template) and ?new()/?api/?eval exposure on untrusted values; do not infer a restricted TemplateClassResolver without captured configuration.', 'Check absent values rendered without a ! default or ?? guard, a bare ! masking required data, and ! precedence guarding only the last segment; report concrete render failures, not optional display values.'],
+  handlebars: ['Check raw {{{value}}}/{{& value}} and double-braced values inside JS/CSS/URL/attribute/event contexts, requiring context-appropriate escaping or URL scheme validation; do not report ordinary {{value}} text the engine escapes by default.', 'Check dynamic partial names ({{> (lookup ...)}} or {{>*name}}) or helper/lambda reinterpretation of untrusted data without an allowlist, and recursive partial chains without data-dependent termination.', 'Check required values silently rendering empty, helper/context name collisions ({{name}} versus {{./name}}), and wrong section/context depth; report concrete output failures, not missing defaults for optional display values.'],
+  jinja: ['Check |safe, Markup or {% autoescape false %} on untrusted values, and HTML-escaped values inside JS/CSS/URL/attribute contexts against the configured autoescaping; do not report every {{ value }} as unescaped.', 'Check template source, expression fragments, filter or macro bodies, or dynamic include/import/extends targets derived from request data without an allowlist, and attr-filter traversal toward sensitive host objects.', 'Check required values silently rendering empty, |default(..., true) swallowing valid 0/False/empty, deep undefined chains, and block overrides dropping {{ super() }} or leaking caller context; report concrete failures only.'],
+  pug: ['Check !{value} / != value on untrusted HTML, escaped #{value} / = value in JS/CSS/JSON/URL/handler contexts, and &attributes(spread) or link/event attributes built from caller-controlled keys and values; do not report ordinary #{value} or = value HTML text.', 'Check script. blocks interpolating values without JS/JSON-safe serialization or without neutralizing </script>, and secrets or oversized objects serialized to client-visible markup.', 'Check attacker-authored template source (compile/render), request-controlled include/extends without an allowlist, and unbuffered code (-) performing filesystem/network/shared-state side effects; do not treat compile-time filters as runtime sanitizers of dynamic locals.'],
+  astro: ['Check set:html on untrusted content, and non-PUBLIC_ env, cookies, headers, sessions or secrets reaching client HTML, scripts or hydrated islands unless the boundary is intentional.', 'Check client:* directives on non-framework components, missing fallback for client:only or server:defer, and over-hydration from large or unnecessary islands.', 'Check props or data crossing server:defer or define:vars boundaries for functions, circular objects, secrets or oversized payloads; do not assume frontmatter values are reactive in the browser.'],
+  terraform: ['Check literal secrets (passwords, API keys, access keys, connection strings) assigned to arguments, variable/locals defaults or committed .tfvars, and credential-shaped variables missing sensitive = true.', 'Check 0.0.0.0/0, ::/0 or "*" sources on sensitive ports and wildcard IAM actions/resources or public ACLs without a public-content purpose stated in the diff.', 'Check committed .tfstate, removed prevent_destroy on stateful resources, stateful resources missing lifecycle where siblings have one, and unbounded provider/module versions where siblings pin; do not flag terraform fmt whitespace.'],
+  bicep: ['Check literal secrets (passwords, connection strings, API keys) on resource properties, parameter defaults or variables, and credential-shaped parameters missing @secure().', 'Check broad roleAssignments (Owner/Contributor), NSG rules with */Internet/0.0.0.0 on sensitive ports, and publicNetworkAccess enabled without compensating networkAcls or private endpoints.', 'Check storage without a pinned minimumTlsVersion or with supportsHttpsTrafficOnly = false only when the diff shows the insecure value, stale api-version relative to siblings, and unpinned module references where siblings pin; do not flag omitted optional hardening alone.']
 };
 export function defectGuidance(filePath, sourceText = '') {
  const lower = filePath.toLowerCase(), protocol = protocolGuidance(filePath);
@@ -44,8 +51,10 @@ export function defectGuidance(filePath, sourceText = '') {
  const language = protocol?.language ?? specialized ?? (/\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic');
  const fileType = /^\.github\/workflows\/.+\.(yaml|yml)$/.test(lower) ? 'github-workflow' : /(?:^|\/)(package\.json|cargo\.toml|pom\.xml|build\.gradle|composer\.json)$/.test(lower) ? 'dependency-manifest' : undefined;
  const purpose = fileType ?? (/\.(ftl|ftlh|ftlx|hbs|mustache|jinja2|j2|pug|astro)$/.test(lower) ? 'template' : /\.(tf|hcl|tfvars|bicep|nix)$/.test(lower) ? 'infrastructure' : /\.(proto|thrift|capnp|graphql|gql|prisma)$/.test(lower) ? 'protocol-schema' : undefined);
- const purposeChecks = purpose === 'template' ? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.'] : purpose === 'infrastructure' ? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.'] : purpose === 'protocol-schema' ? protocol.checks : [];
+ const templateFormat = /\.(ftl|ftlh|ftlx)$/.test(lower) ? 'freemarker' : /\.(hbs|mustache)$/.test(lower) ? 'handlebars' : /\.(jinja2|j2)$/.test(lower) ? 'jinja' : /\.pug$/.test(lower) ? 'pug' : /\.astro$/.test(lower) ? 'astro' : undefined;
+  const infraFormat = /\.(tf|hcl|tfvars)$/.test(lower) ? 'terraform' : /\.bicep$/.test(lower) ? 'bicep' : undefined;
+  const purposeChecks = purpose === 'protocol-schema' ? protocol.checks : purpose === 'template' ? (checklists[templateFormat] ?? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.']) : purpose === 'infrastructure' ? (checklists[infraFormat] ?? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.']) : [];
  const reactChecks = /\.(jsx|tsx)$/.test(lower) ? checklists.react : [];
  const typeChecks = fileType === 'github-workflow' ? ['Check event trust boundaries, token permissions and fork/PR-controlled inputs before privileged commands or secret exposure.', 'Check expression interpolation into shell commands, checkout/ref provenance, artifact/cache trust and required job dependency gates.'] : fileType === 'dependency-manifest' ? ['Check changed dependency versions/features against consumers, lock/resolution evidence and runtime compatibility; do not invent a vulnerability from a package name.', 'Check executable install/build hooks, publish/export entry points and platform constraints for concrete changed behavior.'] : [];
- return { version:5, language, ...(sniffed ? {selection:'bounded-first-nonblank-line-hint'} : {}), ...(purpose ? {fileType:purpose} : {}), checks:[...common,...(checklists[language] ?? []),...reactChecks,...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
+ return { version:5, language, ...(sniffed ? {selection:'bounded-first-nonblank-line-hint'} : {}), ...(purpose ? {fileType:purpose} : {}), ...(templateFormat || infraFormat ? {format: templateFormat ?? infraFormat} : {}), checks:[...common,...(checklists[language] ?? []),...reactChecks,...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
 }