security-review

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Security Review

安全评审

Review the current change like a security-minded senior. Prefer concrete findings over generic advice.

以具备安全意识的资深开发者视角评审当前代码变更。优先给出具体问题，而非通用建议。

Scope

评审范围

Focus on the diff and directly related call paths. Do not audit the whole repo unless asked.

聚焦于代码差异（diff）及直接相关的调用路径。除非明确要求，否则无需审计整个仓库。

Checklist

检查清单

Auth & access

认证与访问控制

Every sensitive action checks authentication and authorization
IDs from the client are not trusted for ownership (
```
userId
```
in body ≠ proof)
Admin/debug routes are gated; no "temporary" open endpoints

每一项敏感操作都同时校验认证状态与权限
不盲目信任客户端传入的ID作为归属凭证（请求体中的
```
userId
```
不能直接证明所有权）
管理员/调试路由需做权限限制；不存在“临时”开放的端点

Input & data

输入与数据处理

User input is validated at the boundary (type, length, allowlist)
SQL/NoSQL/search queries are parameterized — no string concat
HTML/Markdown/user content is escaped or sanitized where rendered
File uploads: size limits, type allowlist, stored outside web root, randomized names
Path joins cannot escape intended directories (
```
../
```
)

用户输入在边界处完成校验（类型、长度、白名单）
SQL/NoSQL/搜索查询采用参数化方式——禁止字符串拼接
HTML/Markdown/用户生成内容在渲染时进行转义或清理
文件上传：设置大小限制、类型白名单，存储在Web根目录外，使用随机文件名
路径拼接不能突破预期目录限制（避免
```
../
```
遍历）

Secrets & config

密钥与配置

No secrets in source, logs, client bundles, or example env files with real values
New env vars documented; defaults are safe for production
Tokens/passwords not written to analytics or error trackers

源代码、日志、客户端包或示例环境文件中无真实密钥
新增环境变量已做文档说明；默认配置在生产环境中是安全的
令牌/密码不会被写入分析工具或错误追踪系统

Network & server

网络与服务器

Outbound fetches do not accept raw user URLs without allowlisting (SSRF)
CORS is least-privilege; credentials only when required
Cookies:
```
HttpOnly
```
,
```
Secure
```
,
```
SameSite
```
where applicable

对外请求不直接接受用户提供的原始URL，需经过白名单校验（防止SSRF）
CORS配置遵循最小权限原则；仅在必要时启用凭证传递
Cookie：按需设置
```
HttpOnly
```
、
```
Secure
```
、
```
SameSite
```
属性

Dangerous APIs

危险API

No
```
eval
```
,
```
dangerouslySetInnerHTML
```
, shell
```
exec
```
with unsanitized input
Deserialization of untrusted data is avoided or hardened
Crypto/auth libraries are standard — no home-rolled JWT/crypto

禁止使用
```
eval
```
、
```
dangerouslySetInnerHTML
```
、未经输入清理的shell
```
exec
```
避免对不可信数据进行反序列化，或已做加固处理
使用标准的加密/认证库——禁止自行实现JWT/加密逻辑

Output format

输出格式

Group findings:

Severity	Rule	Where	Why it matters	Fix
Critical / High / Medium / Low / Note	short name	`file:line` or symbol	1 sentence	concrete change

End with:

Blockers — must fix before merge
Safe to ship with follow-ups — optional

If no issues: say so explicitly and list what you checked.

按以下格式分组展示问题：

严重程度	规则项	位置	影响说明	修复方案
Critical / High / Medium / Low / Note	简短名称	`文件:行号` 或符号	一句话说明	具体修改建议

结尾需包含：

阻塞项 —— 合并前必须修复
可发布但需后续优化 —— 可选修复

若未发现问题：需明确说明，并列出已检查的内容。