canship 0.6.0 → 0.7.1

package/README-zh-CN.md

@@ -4,7 +4,7 @@
 
 [English](./README.md)
 
-> 本文对应 `0.6.0`。使用 `npx canship --version` 确认已安装版本。
+> 本文对应 `0.7.1`。使用 `npx canship --version` 确认已安装版本。
 
 ## 快速开始
 
@@ -39,10 +39,17 @@ npx canship
 | Nuxt | `server/api`、`server/routes` |
 | Remix / React Router | `app/routes` 中的 `loader`、`action` 导出 |
 | Astro | `src/pages` 中的端点 |
+| Express | `app`/`Router` 路由，含 `.route()` 链、挂载的子路由和其他文件中的控制器 |
+| Hono | `app.get()` 等路由、链式调用、`basePath`，以及 `app.route()` 挂载的子应用 |
+| Fastify | 简写与 `route()` 声明、`register()` 前缀与封装作用域、`@fastify/autoload` 目录 |
 
-已识别的 Next.js/Astro 中间件可抑制覆盖范围内的鉴权结果；Server Function 需在函数内检查。本地辅助函数、SvelteKit hooks、Nuxt 中间件可降低置信度，但保留结果。输入分析追踪可见的赋值、解构和字符串构造，不以辅助函数名称证明安全。
+已识别的 Next.js/Astro 中间件可抑制匹配路由的鉴权结果；Server Function 需在函数内检查。Express/Hono/Fastify 仅接受已解析的拒绝逻辑或已知鉴权库。Fastify 装饰器和插件的保护证据限定于当前实例。
 
-路由分析不覆盖 SvelteKit 页面 load、remote function，以及独立的 Express/Hono/Fastify 处理函数；凭据、CORS 等内容规则仍适用。
+会话校验及 webhook 验签（Stripe、Polar、Clerk、Svix、QStash）须在失败时拒绝请求，异步调用须等待或返回。项目辅助函数与包装器、SvelteKit hooks、Nuxt 中间件的间接证据可降低置信度；未解析的鉴权来源不能消除结果。
+
+输入追踪支持赋值、解构、字符串构造及可解析的跨文件透传函数，不以辅助函数名称证明输入已净化。
+
+Express、Hono、Fastify 路由会跟进被调项目函数中的写入，最多两层（处理函数 → service → model）；文件约定路由只报告路由文件内的写入。路由分析不覆盖 SvelteKit 页面 load、remote function 和 Hono 的 `app.openapi()` 路由；凭据、CORS 等内容规则仍适用。
 
 ## 结果
 
@@ -118,9 +125,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@97c14d1f1e494a49adf716c455b597edf6ae1d88
+      - uses: Tasomei/canship@7465c9560b8b3692777af080e8cc67b4be2335d7
         with:
-          version: '0.6.0'
+          version: '0.7.1'
           honor-ignore-markers: false
 ```
 
@@ -128,7 +135,7 @@ jobs:
 
 | 输入 | 默认值 | 含义 |
 |---|---|---|
-| `version` | `0.5.0` | 精确 npm 扫描器版本 |
+| `version` | `0.7.0` | 精确 npm 扫描器版本 |
 | `fail-on` | `blocking` | `blocking`：确定的 P0/P1；`any`：全部结果；`none`：仅报告 |
 
 扫描不完整或工具错误始终失败。默认不读取项目配置、不上传 SARIF。输入输出见 [action.yml](./action.yml)。
@@ -154,7 +161,7 @@ JSON 使用 [schemaVersion 1](./schemas/scan-report-v1.schema.json)。须独立
 - 脱敏仅覆盖已识别格式，未知敏感值可能保留在摘录中；`--no-excerpts` 可移除摘录。路径、名称和基线描述仍可见。
 - Google/Firebase/Maps 的 `AIza…` 密钥按公开标识符处理，不单凭其值判定泄露。Supabase 检查依据本地迁移及支持的存储桶配置。
 - 评估快照获取和可选的 SARIF 上传可能联网。
-- 不跟随符号链接；嵌套仓库与子模块需单独扫描。范围内跳过项及分析超限标记扫描不完整；默认排除的依赖和构建目录不计为扫描缺口。
+- 不跟随符号链接；嵌套仓库与子模块需单独扫描。范围内跳过项及分析超限标记扫描不完整；鉴权辅助函数解析超限不会隐藏结果，改为在受影响的结果上注明。默认排除的依赖和构建目录不计为扫描缺口。
 
 | 项目 | 上限 |
 |---|---|
@@ -162,9 +169,10 @@ JSON 使用 [schemaVersion 1](./schemas/scan-report-v1.schema.json)。须独立
 | 目录遍历 | 50,000 个条目；16 层 |
 | 结果 | 每文件 100 条，优先保留高严重度、高置信度结果 |
 | Git 历史 | 每文件 100 个相关版本；单条命令 30 秒 |
-| 鉴权解析 | 8 跳；每个路由文件 128 个符号 |
+| 鉴权辅助函数解析 | 8 跳；每个辅助函数 64 个符号，每个路由文件共 1,024 个 |
+| 委托写入 | 调用 2 层；每个文件 256 个被调函数；超出部分的写入不报告 |
 | 身份/控制流 | 值解析 8 步；表达式 4,000 字符；每函数 512 个赋值/区域；区域嵌套 8 层 |
-| 请求输入追踪 | 值解析 8 步；512 个赋值/区域；表达式 4,000 字符；URL 分析 8 层、静态前缀 200 字符 |
+| 请求输入追踪 | 值解析 8 步；512 个赋值/区域；单条表达式 64 KiB；URL 分析 8 层、静态前缀 200 字符 |
 | Supabase 策略/存储桶解析 | 单条语句 4,000 字符 |
 
 证据链最多 24 步，截断时提示。

package/README.md

@@ -4,7 +4,7 @@ A local static scanner for JavaScript and TypeScript web apps. Checks exposed cr
 
 [简体中文](./README-zh-CN.md)
 
-> Documentation for `0.6.0`. Check the installed version with `npx canship --version`.
+> Documentation for `0.7.1`. Check the installed version with `npx canship --version`.
 
 ## Quick start
 
@@ -39,10 +39,17 @@ Credential formats include OpenAI, Anthropic, AWS, Stripe, GitHub, and npm. Fire
 | Nuxt | `server/api`, `server/routes` |
 | Remix / React Router | `loader` and `action` exports in `app/routes` |
 | Astro | Endpoints in `src/pages` |
+| Express | `app`/`Router` routes, including `.route()` chains, mounted routers, and controllers in other files |
+| Hono | `app.get()`-style routes, chains, `basePath`, and sub-apps mounted with `app.route()` |
+| Fastify | Shorthand and `route()` declarations, `register()` prefixes and encapsulation, `@fastify/autoload` directories |
 
-Recognised Next.js/Astro middleware may suppress covered auth findings; Server Functions need local checks. Local helpers, SvelteKit hooks, and Nuxt middleware may lower confidence without suppressing findings. Input analysis follows visible assignments, destructuring, and string construction; helper names alone do not prove sanitisation.
+Recognised Next.js/Astro middleware may suppress covered auth findings; Server Functions need local checks. Express/Hono/Fastify require resolved rejection logic or known auth libraries. Fastify decorator and plugin evidence is scoped to the local instance.
 
-SvelteKit page loads, remote functions, and standalone Express/Hono/Fastify handlers are outside route analysis. Content-based checks, including credentials and CORS, still apply.
+Session checks and webhook verification (Stripe, Polar, Clerk, Svix, QStash) must reject failures; asynchronous calls must be awaited or returned. Indirect evidence from project helpers/wrappers, SvelteKit hooks, or Nuxt middleware may lower confidence. Unresolved auth sources do not suppress findings.
+
+Input analysis follows assignments, destructuring, string construction, and resolvable cross-file passthrough helpers. Helper names alone do not prove sanitisation.
+
+For Express, Hono, and Fastify routes, writes inside called project functions are followed two levels (handler → service → model); file-based routes report writes in the route file only. SvelteKit page loads, remote functions, and Hono `app.openapi()` routes are outside route analysis. Content-based checks, including credentials and CORS, still apply.
 
 ## Results
 
@@ -118,9 +125,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@97c14d1f1e494a49adf716c455b597edf6ae1d88
+      - uses: Tasomei/canship@7465c9560b8b3692777af080e8cc67b4be2335d7
         with:
-          version: '0.6.0'
+          version: '0.7.1'
           honor-ignore-markers: false
 ```
 
@@ -128,7 +135,7 @@ The commit hash pins the Action implementation; `version` selects the npm scanne
 
 | Input | Default | Meaning |
 |---|---|---|
-| `version` | `0.5.0` | Exact npm scanner version |
+| `version` | `0.7.0` | Exact npm scanner version |
 | `fail-on` | `blocking` | `blocking`: certain P0/P1; `any`: all findings; `none`: report only |
 
 Incomplete scans and tool errors always fail. Project configuration and SARIF upload are disabled by default. Inputs and outputs: [action.yml](./action.yml).
@@ -154,7 +161,7 @@ JSON uses [schemaVersion 1](./schemas/scan-report-v1.schema.json). Check `partia
 - Redaction covers recognised formats only. Unknown secrets may remain in excerpts; `--no-excerpts` omits excerpts. Paths, names, and baseline descriptions remain visible.
 - Google/Firebase/Maps `AIza…` keys are treated as public identifiers, not leak evidence alone. Supabase checks use local migrations and supported bucket configuration.
 - Evaluation snapshot downloads and optional SARIF uploads may use the network.
-- Symbolic links are not followed; nested repositories and submodules need separate scans. In-scope skipped paths and analysis limits mark coverage incomplete. Dependency and build directories excluded by default do not count as coverage gaps.
+- Symbolic links are not followed; nested repositories and submodules need separate scans. In-scope skipped paths and analysis limits mark coverage incomplete; auth helper resolution limits are noted on the affected finding instead, because they cannot hide findings. Dependency and build directories excluded by default do not count as coverage gaps.
 
 | Limit | Bound |
 |---|---|
@@ -162,9 +169,10 @@ JSON uses [schemaVersion 1](./schemas/scan-report-v1.schema.json). Check `partia
 | Directory discovery | 50,000 entries; 16 levels |
 | Findings | 100 per file, prioritising severity and confidence |
 | Git history | 100 relevant revisions per file; 30 seconds per command |
-| Auth resolution | 8 hops; 128 symbols per route file |
+| Auth helper resolution | 8 hops; 64 symbols per helper, 1,024 per route file |
+| Delegated writes | 2 call levels; 256 callees per file; writes beyond these limits are not reported |
 | Identity/control flow | 8 value hops; 4,000 expression characters; 512 assignments/regions per function; 8 nested regions |
-| Request-input tracking | 8 value hops; 512 assignments/regions; 4,000 expression characters; 8 URL-analysis levels; 200 static-prefix characters |
+| Request-input tracking | 8 value hops; 512 assignments/regions; 64 KiB per expression; 8 URL-analysis levels; 200 static-prefix characters |
 | Supabase policy/bucket parsing | 4,000 characters per statement |
 
 Evidence traces are capped at 24 steps and disclose truncation.