canship 0.6.0 → 0.7.0

package/README-zh-CN.md

@@ -4,7 +4,7 @@
 
 [English](./README.md)
 
-> 本文对应 `0.6.0`。使用 `npx canship --version` 确认已安装版本。
+> 本文对应 `0.7.0`。使用 `npx canship --version` 确认已安装版本。
 
 ## 快速开始
 
@@ -39,10 +39,13 @@ npx canship
 | Nuxt | `server/api`、`server/routes` |
 | Remix / React Router | `app/routes` 中的 `loader`、`action` 导出 |
 | Astro | `src/pages` 中的端点 |
+| Express | `app`/`Router` 路由，含 `.route()` 链、挂载的子路由和其他文件中的控制器 |
+| Hono | `app.get()` 等路由、链式调用、`basePath`，以及 `app.route()` 挂载的子应用 |
+| Fastify | 简写与 `route()` 声明、`register()` 前缀与封装作用域、`@fastify/autoload` 目录 |
 
-已识别的 Next.js/Astro 中间件可抑制覆盖范围内的鉴权结果；Server Function 需在函数内检查。本地辅助函数、SvelteKit hooks、Nuxt 中间件可降低置信度，但保留结果。输入分析追踪可见的赋值、解构和字符串构造，不以辅助函数名称证明安全。
+已识别的 Next.js/Astro 中间件可抑制覆盖范围内的鉴权结果；Server Function 需在函数内检查。Express、Hono、Fastify 的中间件与钩子只有解析到拒绝未认证请求的代码或已知鉴权库时才抑制鉴权结果；名称像鉴权但无法解析的中间件降低置信度。项目自定义的会话或凭据校验（如 `validateSessionToken`）及 webhook 验签（Stripe、Polar、Clerk、Svix，以及 QStash `receiver.verify` 这类须 await 的校验）只有在失败分支抛出、跳转或返回 401/403 时才算鉴权。本地辅助函数、含鉴权逻辑的项目包装函数（如 `withWorkspace`）、SvelteKit hooks、Nuxt 中间件可降低置信度或将结果标为待复核，但保留结果。输入分析追踪可见的赋值、解构和字符串构造，不以辅助函数名称证明安全。
 
-路由分析不覆盖 SvelteKit 页面 load、remote function，以及独立的 Express/Hono/Fastify 处理函数；凭据、CORS 等内容规则仍适用。
+Express、Hono、Fastify 路由会跟进被调项目函数中的写入，最多两层（处理函数 → service → model）；文件约定路由只报告路由文件内的写入。路由分析不覆盖 SvelteKit 页面 load、remote function 和 Hono 的 `app.openapi()` 路由；凭据、CORS 等内容规则仍适用。
 
 ## 结果
 
@@ -118,9 +121,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@97c14d1f1e494a49adf716c455b597edf6ae1d88
+      - uses: Tasomei/canship@7dfebc9502b786edd5c7fd71266e4926d0ad764b
         with:
-          version: '0.6.0'
+          version: '0.7.0'
           honor-ignore-markers: false
 ```
 
@@ -128,7 +131,7 @@ jobs:
 
 | 输入 | 默认值 | 含义 |
 |---|---|---|
-| `version` | `0.5.0` | 精确 npm 扫描器版本 |
+| `version` | `0.6.0` | 精确 npm 扫描器版本 |
 | `fail-on` | `blocking` | `blocking`：确定的 P0/P1；`any`：全部结果；`none`：仅报告 |
 
 扫描不完整或工具错误始终失败。默认不读取项目配置、不上传 SARIF。输入输出见 [action.yml](./action.yml)。
@@ -154,7 +157,7 @@ JSON 使用 [schemaVersion 1](./schemas/scan-report-v1.schema.json)。须独立
 - 脱敏仅覆盖已识别格式，未知敏感值可能保留在摘录中；`--no-excerpts` 可移除摘录。路径、名称和基线描述仍可见。
 - Google/Firebase/Maps 的 `AIza…` 密钥按公开标识符处理，不单凭其值判定泄露。Supabase 检查依据本地迁移及支持的存储桶配置。
 - 评估快照获取和可选的 SARIF 上传可能联网。
-- 不跟随符号链接；嵌套仓库与子模块需单独扫描。范围内跳过项及分析超限标记扫描不完整；默认排除的依赖和构建目录不计为扫描缺口。
+- 不跟随符号链接；嵌套仓库与子模块需单独扫描。范围内跳过项及分析超限标记扫描不完整；鉴权辅助函数解析超限不会隐藏结果，改为在受影响的结果上注明。默认排除的依赖和构建目录不计为扫描缺口。
 
 | 项目 | 上限 |
 |---|---|
@@ -162,9 +165,10 @@ JSON 使用 [schemaVersion 1](./schemas/scan-report-v1.schema.json)。须独立
 | 目录遍历 | 50,000 个条目；16 层 |
 | 结果 | 每文件 100 条，优先保留高严重度、高置信度结果 |
 | Git 历史 | 每文件 100 个相关版本；单条命令 30 秒 |
-| 鉴权解析 | 8 跳；每个路由文件 128 个符号 |
+| 鉴权辅助函数解析 | 8 跳；每个辅助函数 64 个符号，每个路由文件共 1,024 个 |
+| 委托写入 | 调用 2 层；每个文件 256 个被调函数；超出部分的写入不报告 |
 | 身份/控制流 | 值解析 8 步；表达式 4,000 字符；每函数 512 个赋值/区域；区域嵌套 8 层 |
-| 请求输入追踪 | 值解析 8 步；512 个赋值/区域；表达式 4,000 字符；URL 分析 8 层、静态前缀 200 字符 |
+| 请求输入追踪 | 值解析 8 步；512 个赋值/区域；单条表达式 64 KiB；URL 分析 8 层、静态前缀 200 字符 |
 | Supabase 策略/存储桶解析 | 单条语句 4,000 字符 |
 
 证据链最多 24 步，截断时提示。

package/README.md

@@ -4,7 +4,7 @@ A local static scanner for JavaScript and TypeScript web apps. Checks exposed cr
 
 [简体中文](./README-zh-CN.md)
 
-> Documentation for `0.6.0`. Check the installed version with `npx canship --version`.
+> Documentation for `0.7.0`. Check the installed version with `npx canship --version`.
 
 ## Quick start
 
@@ -39,10 +39,13 @@ Credential formats include OpenAI, Anthropic, AWS, Stripe, GitHub, and npm. Fire
 | Nuxt | `server/api`, `server/routes` |
 | Remix / React Router | `loader` and `action` exports in `app/routes` |
 | Astro | Endpoints in `src/pages` |
+| Express | `app`/`Router` routes, including `.route()` chains, mounted routers, and controllers in other files |
+| Hono | `app.get()`-style routes, chains, `basePath`, and sub-apps mounted with `app.route()` |
+| Fastify | Shorthand and `route()` declarations, `register()` prefixes and encapsulation, `@fastify/autoload` directories |
 
-Recognised Next.js/Astro middleware may suppress covered auth findings; Server Functions need local checks. Local helpers, SvelteKit hooks, and Nuxt middleware may lower confidence without suppressing findings. Input analysis follows visible assignments, destructuring, and string construction; helper names alone do not prove sanitisation.
+Recognised Next.js/Astro middleware may suppress covered auth findings; Server Functions need local checks. Express, Hono, and Fastify middleware and hooks suppress auth findings only when they resolve to code that rejects unauthenticated requests or to a known auth library; auth-like middleware that cannot be followed lowers confidence. Project session or credential checks (such as `validateSessionToken`) and webhook signature verification (Stripe, Polar, Clerk, Svix, and awaited checks such as QStash `receiver.verify`) count only when the failing branch throws, redirects, or returns 401/403. Local helpers, project wrappers that contain authentication (such as `withWorkspace`), SvelteKit hooks, and Nuxt middleware may lower confidence or mark findings for review without suppressing them. Input analysis follows visible assignments, destructuring, and string construction; helper names alone do not prove sanitisation.
 
-SvelteKit page loads, remote functions, and standalone Express/Hono/Fastify handlers are outside route analysis. Content-based checks, including credentials and CORS, still apply.
+For Express, Hono, and Fastify routes, writes inside called project functions are followed two levels (handler → service → model); file-based routes report writes in the route file only. SvelteKit page loads, remote functions, and Hono `app.openapi()` routes are outside route analysis. Content-based checks, including credentials and CORS, still apply.
 
 ## Results
 
@@ -118,9 +121,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@97c14d1f1e494a49adf716c455b597edf6ae1d88
+      - uses: Tasomei/canship@7dfebc9502b786edd5c7fd71266e4926d0ad764b
         with:
-          version: '0.6.0'
+          version: '0.7.0'
           honor-ignore-markers: false
 ```
 
@@ -128,7 +131,7 @@ The commit hash pins the Action implementation; `version` selects the npm scanne
 
 | Input | Default | Meaning |
 |---|---|---|
-| `version` | `0.5.0` | Exact npm scanner version |
+| `version` | `0.6.0` | Exact npm scanner version |
 | `fail-on` | `blocking` | `blocking`: certain P0/P1; `any`: all findings; `none`: report only |
 
 Incomplete scans and tool errors always fail. Project configuration and SARIF upload are disabled by default. Inputs and outputs: [action.yml](./action.yml).
@@ -154,7 +157,7 @@ JSON uses [schemaVersion 1](./schemas/scan-report-v1.schema.json). Check `partia
 - Redaction covers recognised formats only. Unknown secrets may remain in excerpts; `--no-excerpts` omits excerpts. Paths, names, and baseline descriptions remain visible.
 - Google/Firebase/Maps `AIza…` keys are treated as public identifiers, not leak evidence alone. Supabase checks use local migrations and supported bucket configuration.
 - Evaluation snapshot downloads and optional SARIF uploads may use the network.
-- Symbolic links are not followed; nested repositories and submodules need separate scans. In-scope skipped paths and analysis limits mark coverage incomplete. Dependency and build directories excluded by default do not count as coverage gaps.
+- Symbolic links are not followed; nested repositories and submodules need separate scans. In-scope skipped paths and analysis limits mark coverage incomplete; auth helper resolution limits are noted on the affected finding instead, because they cannot hide findings. Dependency and build directories excluded by default do not count as coverage gaps.
 
 | Limit | Bound |
 |---|---|
@@ -162,9 +165,10 @@ JSON uses [schemaVersion 1](./schemas/scan-report-v1.schema.json). Check `partia
 | Directory discovery | 50,000 entries; 16 levels |
 | Findings | 100 per file, prioritising severity and confidence |
 | Git history | 100 relevant revisions per file; 30 seconds per command |
-| Auth resolution | 8 hops; 128 symbols per route file |
+| Auth helper resolution | 8 hops; 64 symbols per helper, 1,024 per route file |
+| Delegated writes | 2 call levels; 256 callees per file; writes beyond these limits are not reported |
 | Identity/control flow | 8 value hops; 4,000 expression characters; 512 assignments/regions per function; 8 nested regions |
-| Request-input tracking | 8 value hops; 512 assignments/regions; 4,000 expression characters; 8 URL-analysis levels; 200 static-prefix characters |
+| Request-input tracking | 8 value hops; 512 assignments/regions; 64 KiB per expression; 8 URL-analysis levels; 200 static-prefix characters |
 | Supabase policy/bucket parsing | 4,000 characters per statement |
 
 Evidence traces are capped at 24 steps and disclose truncation.