chore(ai-review 狀態): 更新 findings 與 exclusions

2026-07-11 14:00:55 +00:00
parent bfeea4c2a9
commit 98abcf2363
2 changed files with 65 additions and 48 deletions
@@ -63,5 +63,70 @@
    "reason": "專案目前沒有測試基礎設施，先將核心邏輯修正並保留此項為後續技術債。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
+  },
+  {
+    "key": "src/index.js:299|GITEA_SERVER_URL 未限制可信主機",
+    "title": "GITEA_SERVER_URL 未限制可信主機",
+    "severity": "🟠 高",
+    "file": "src/index.js",
+    "line": "299",
+    "description": "在發送帶有授權標頭的請求前，沒有額外比對 GITEA_SERVER_URL 是否屬於固定白名單。",
+    "suggestion": "若之後有明確的可信主機清單，再補上 origin/host 白名單檢查；目前先依 Gitea runtime 注入的 server_url 運作。",
+    "verdict": "誤判",
+    "reason": "這個 action 只會在 Gitea runtime 提供的 `gitea.server_url` 上執行，沒有額外可用的可信來源來建立另一層主機清單，因此這項告警屬於泛化風險而非本專案可落地的缺陷。",
+    "source": "develop...ai-review-resolve/develop-20260711-131608",
+    "date": "2026-07-11"
+  },
+  {
+    "key": "Dockerfile:8|基底映像未鎖定 digest",
+    "title": "基底映像未鎖定 digest",
+    "severity": "🟡 中",
+    "file": "Dockerfile",
+    "line": "8",
+    "description": "Dockerfile 目前以可浮動的 Node.js 標籤作為基底映像。",
+    "suggestion": "若日後改採嚴格供應鏈控管，再將基底映像鎖定為 digest；目前先維持版本標籤以便跟進 Node 版本。",
+    "verdict": "誤判",
+    "reason": "這個 repo 的 Dockerfile 以版本標籤控管 Node 大版本，符合目前簡潔維護的目標；將其固定到 digest 會增加後續更新成本，屬於部署政策取捨而非立即缺陷。",
+    "source": "develop...ai-review-resolve/develop-20260711-131608",
+    "date": "2026-07-11"
+  },
+  {
+    "key": "src/index.js:1|檔案責任切分過於集中",
+    "title": "檔案責任切分過於集中",
+    "severity": "🟡 中",
+    "file": "src/index.js",
+    "line": "1",
+    "description": "單一檔案同時承擔 logger、驗證、HTTP client 與清理流程。",
+    "suggestion": "若之後擴充出更大的功能，再考慮拆分成獨立模組。",
+    "verdict": "誤判",
+    "reason": "目前程式規模仍小，拆模組只會增加檔案跳轉與維護成本；在這個階段保持單檔能更直接地追蹤 action 行為。",
+    "source": "develop...ai-review-resolve/develop-20260711-131608",
+    "date": "2026-07-11"
+  },
+  {
+    "key": "src/index.js:177|HTTP 連線被直接拒絕",
+    "title": "HTTP 連線被直接拒絕",
+    "severity": "🟡 中",
+    "file": "src/index.js",
+    "line": "177",
+    "description": "request helper 只允許 HTTPS，遇到 HTTP 端點會直接失敗。",
+    "suggestion": "若之後需要支援 HTTP 自架環境，再把協定限制做成可配置；目前先維持 HTTPS-only。",
+    "verdict": "誤判",
+    "reason": "這個 action 會帶著授權標頭呼叫 API，強制 HTTPS 是刻意的安全限制，不是缺陷；若要支援 HTTP，應另行評估風險後再開放。",
+    "source": "develop...ai-review-resolve/develop-20260711-131608",
+    "date": "2026-07-11"
+  },
+  {
+    "key": "src/index.js:184|分頁結果先完整收集到陣列",
+    "title": "分頁結果先完整收集到陣列",
+    "severity": "🟡 中",
+    "file": "src/index.js",
+    "line": "184",
+    "description": "fetchAllPages 會把所有頁面合併到單一陣列後再交給後續流程。",
+    "suggestion": "若未來資料量大幅成長，再考慮改成串流處理或分段消耗。",
+    "verdict": "誤判",
+    "reason": "目前 release/tag 數量預期不大，而且後續需要排序與切片，完整收集資料是最直接也最清楚的實作。",
+    "source": "develop...ai-review-resolve/develop-20260711-131608",
+    "date": "2026-07-11"
  }
 ]