secure-code-review

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Review code for vulnerabilities systematically, not line-by-line.

系统性地审查代码中的漏洞，而非逐行检查。

What does this code do? Identify: entry points, trust boundaries, data stores, privileged operations
Read the tests — what invariants do they reveal?
Check the diff's blast radius: auth logic? parsing? file handling? crypto?

Follow each input from entry point to sink:

Sink Class	What to Verify
SQL/NoSQL	Parameterized; no string-built queries; identifiers whitelisted
Command exec	No user data in shell strings; argv-array APIs; no shell=True
HTML/rendering	Contextual auto-escaping; raw/unsafe HTML flags justified
File paths	Basename/allowlist; canonicalize + prefix check; no user paths in includes
Deserialization	Typed formats (JSON) over object serializers; validation post-parse
Redirects	Relative-only or allowlisted targets
Eval/dynamic code	Justified and input-free, or rejected

追踪每个输入从入口点到接收端的路径：

接收端类别	验证要点
SQL/NoSQL	使用参数化查询；禁止拼接字符串构建查询；标识符需在白名单内
命令执行	命令字符串中不包含用户数据；使用参数数组API；禁止设置shell=True
HTML/渲染	按上下文自动转义；合理使用原始/不安全HTML标记
文件路径	使用文件名/白名单；规范化路径并检查前缀；引入文件时不使用用户提供的路径
反序列化	优先使用类型化格式（如JSON）而非对象序列化器；解析后进行验证
重定向	仅允许相对路径或白名单内的目标地址
求值/动态代码	仅在合理且无用户输入的情况下使用，否则拒绝

Every endpoint enforces authz server-side; role checks at the resource, not the controller only
Object-level checks (IDOR): does the query filter by the caller's tenant/user ID?
Session management: rotation, invalidation, secure cookie flags
Password reset flows: token entropy, expiry, single-use, no account enumeration

No hardcoded credentials/keys/API tokens; no secrets in logs or error messages
Crypto: approved algorithms, library primitives (not hand-rolled), correct modes, random from CSPRNG

Report findings with severity, the specific code path, an exploit sketch, and a suggested fix. Distinguish "must fix" from "harden later."

报告发现时需包含严重程度、具体代码路径、漏洞利用示意图及修复建议。区分"必须修复"与"后续强化"的问题。