Commit Graph

2 Commits (cec3b09531611ba36d3e418bc793548b6e416205)

Author SHA1 Message Date
Council cec3b09531 council(draft): SecurityEngineer - Round 2 安全评估更新:XSS确认 + ClearCache Bug + QR code字段验证
新增发现:
- P3: $goods['content'] XSS(admin可控,建议转义)
- P3: ClearCache $goodsId 未定义 Bug(不影响票务链路)
- 确认: QR payload 已含 code 字段(Gap 3 不存在)

投票维持:C(双线并行)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 17:21:24 +08:00
Council 8eeeb72f03 council(draft): SecurityEngineer - 安全评估:支付链路 + Issue #6 + FOR UPDATE
审计范围:
- 购物车→支付→QR票生成链路
- FOR UPDATE SKIP LOCKED 防超卖实现
- QR签名机制(HMAC-SHA256)
- BaseService QR Secret 硬编码风险
- 前端XSS初步评估

结论:无P0漏洞,支付链路整体安全。投票C(双线并行)。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 17:16:48 +08:00