golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.3): record code review disposition

Browse Source
This commit is contained in:
Jakub Zych
2026-10-15 20:18:44 +02:00
parent 1ec6aa4364
commit 6cd29eae35
1 changed files with 123 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

123
.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/19.3-REVIEW-DISPOSITION.md Normal file
View File

@@ -0,0 +1,123 @@
---
phase: 19.3
review: 19.3-REVIEW.md
titles: json
findings:
- id: CR-01
severity: critical
disposition: open
title: "`cors:<profile>` headers are missing from every response produced outside the profile middleware (401, 403, 413, 422, 429, 500)"
- id: WR-01
severity: warning
disposition: open
title: "The site-cache purge runs synchronously in the admin request, and bulk delete multiplies it"
- id: WR-02
severity: warning
disposition: open
title: "The purge client follows redirects and forwards the bearer token, including https-to-http on the same host"
- id: WR-03
severity: warning
disposition: open
title: "The shipped purge route refuses every proxied request, so the https/remote mode the Go side advertises cannot work"
- id: WR-04
severity: warning
disposition: open
title: "Credentialed CORS validation only refuses a bare `*`; a wildcard entry or an unanchored pattern still trusts arbitrary origins with credentials"
- id: WR-05
severity: warning
disposition: open
title: "In production, the cookie's Secure flag is inferred false without an error when `app.url` is http or unset"
- id: WR-06
severity: warning
disposition: open
title: "The api-docs CSP allowlists all of jsDelivr for scripts, which cancels the nonce"
- id: WR-07
severity: warning
disposition: open
title: "`storage.uploads.public_url` puts protected (`is_public=false`) files in a publicly served bucket"
- id: WR-08
severity: warning
disposition: open
title: "`turnstile:open` without a secret switches off bot protection in production, with nothing logged"
- id: WR-09
severity: warning
disposition: open
title: "The zero `CookieConfig` does not give the documented default attributes (no SameSite, no Secure)"
- id: IN-01
severity: info
disposition: open
title: "The cache prefix has no enforced separator, so one application's Flush can reach another's keys"
- id: IN-02
severity: info
disposition: open
title: "The purge token is not trimmed although the URL is"
- id: IN-03
severity: info
disposition: open
title: "The purge and the Journal alias wiring log through `slog.Default()` instead of the app logger"
- id: IN-04
severity: info
disposition: open
title: "`SiteCacheFromApp` logs an Error on every call when the configuration is invalid"
- id: IN-05
severity: info
disposition: open
title: "The Turnstile middleware buffers the whole body even for content types it never parses"
- id: IN-06
severity: info
disposition: open
title: "Each preflight route copies the constraints of the first route on its path only"
- id: IN-07
severity: info
disposition: open
title: "The `DiskExtension` script-capable denylist is incomplete"
- id: IN-08
severity: info
disposition: open
title: "The cookie refresh and logout handlers do not check `Origin`"
- id: IN-09
severity: info
disposition: open
title: "Timing-sensitive cooler unit tests may flake on loaded CI"
- id: IN-10
severity: info
disposition: open
title: "The `purgeSiteCache` helper is copied across the FAQ and menu plugins, with a third variant in the Journal"
- id: IN-11
severity: info
disposition: open
title: "A published `*bouncer.Turnstile` silently overrides `turnstile.secret`"
open: 21
total: 21
recorded: 2026-10-15T18:18:43.865Z
---
# Phase 19.3: Code Review Disposition
| Finding | Severity | Disposition | Source |
|---------|----------|-------------|--------|
| CR-01 | critical | open | - |
| WR-01 | warning | open | - |
| WR-02 | warning | open | - |
| WR-03 | warning | open | - |
| WR-04 | warning | open | - |
| WR-05 | warning | open | - |
| WR-06 | warning | open | - |
| WR-07 | warning | open | - |
| WR-08 | warning | open | - |
| WR-09 | warning | open | - |
| IN-01 | info | open | - |
| IN-02 | info | open | - |
| IN-03 | info | open | - |
| IN-04 | info | open | - |
| IN-05 | info | open | - |
| IN-06 | info | open | - |
| IN-07 | info | open | - |
| IN-08 | info | open | - |
| IN-09 | info | open | - |
| IN-10 | info | open | - |
| IN-11 | info | open | - |
Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`.
Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run.
Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.