golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19): unique threat IDs T-19-13 and T-19-14

Browse Source 
Duplicate T-19-04/T-19-06 across plans blocked execute-phase; keep the
originals on 19-01 and 19-03 and give the later plans new registers.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-10-17 20:37:12 +02:00
parent eab4528a5a
commit 9404668287
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.planning/phases/19-chat-and-chatchannels/19-04-PLAN.md
View File

@@ -248,7 +248,7 @@ Commit sm-user-plugin on its own (core-plugins-own-repos). Push only if the huma
|-----------|----------|-----------|----------|-------------|-----------------|
| T-19-07 | Information disclosure | user.Deleting → SeverUserFromContext | high | mitigate | Fire Deleting in the delete tx; TestDeletingCascade |
| T-19-10 | Elevation of privilege | user namespace authorizer | high | mitigate | Allow only user:{id} for that user; skip-if-registered; TestUserAuthorizer |
| T-19-06 | Elevation of privilege | mention resolve (completed here) | high | mitigate | Participant-only handle match; TestHandleMention |
| T-19-14 | Elevation of privilege | mention resolve (completed here) | high | mitigate | Participant-only handle match; TestHandleMention |
| T-19-SC | Tampering | go.mod requires | high | mitigate | No new packages; analog handle migration only |
</threat_model>

4
.planning/phases/19-chat-and-chatchannels/19-05-PLAN.md
View File

@@ -141,7 +141,7 @@ scripts/check-phase19.3.sh
<read_first>/media/nvme/dev/jz/wavepath.org/plugins/golem15/chat/models/Message.php, /media/nvme/dev/jz/wavepath.org/plugins/golem15/chat/traits/ChatBroadcasting.php, ../sm-chat-plugin/models/message.go, ../sm-chat-plugin/harness_test.go, modules/lighthouse/drivers.go, ../sm-paymentgatewaysubscriptions-plugin/fixture_plugin_test.go</read_first>
<action>Per SC-19-3 and D-21, land one production golden pair that the rest of the suite will copy. Author testdata/goldens/message_to_api_array.json from PHP toApiArray keys (id, conversation_id, sender_id, sender_name, sender_avatar, content, type, attachments[{id,url,filename,size,mime_type,kind,width,height}], created_at, created_at_human, edited_at, deleted_at, is_mine) plus root_id (RESEARCH Q2). Author created_chat_message.json from ChatBroadcasting: event created.chat.message, channels = context BroadcastChannel + chat:conversation:{id}, payload id, conversation_id, sender_id, root_id, type, action, created_at. Prefer a live Wavepath capture when one is on disk; otherwise freeze the PHP source at 943b712 and record `_source` in the JSON. Normalize URL prefix to /_chat/api/v1 before compare (D-10).
golden_test.go TestToAPIArray (short): build a message with one image attachment (kind, width, height set) and compare keys and scalar fields to the golden. TestGoldenEvents (short or memory driver): MemoryDriver.Publications() for a SendMessage matches created_chat_message.json name, channels and payload; fail if any publication map contains key content (T-19-04).
golden_test.go TestToAPIArray (short): build a message with one image attachment (kind, width, height set) and compare keys and scalar fields to the golden. TestGoldenEvents (short or memory driver): MemoryDriver.Publications() for a SendMessage matches created_chat_message.json name, channels and payload; fail if any publication map contains key content (T-19-13).
queststream_trace_test.go TestNoQuestStreamTrace (short): walk production .go / .yaml / .md (exclude testdata, *_test.go, PHP_METHOD_MAP.md) and fail if any of the four D-02 tokens appear; also fail if acme.teams appears outside test files. Use grep -v '^#' style filters so comments in this plan are irrelevant.
@@ -229,7 +229,7 @@ Update 19-VALIDATION.md task IDs from 19-W0-* to 19-01 / 19-02 / 19-03 / 19-04 /
| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
|-----------|----------|-----------|----------|-------------|-----------------|
| T-19-04 | Information disclosure | TestGoldenEvents | high | mitigate | Fail if a MemoryDriver publication contains content (already required in Task 1) |
| T-19-13 | Information disclosure | TestGoldenEvents | high | mitigate | Fail if a MemoryDriver publication contains content (already required in Task 1) |
| T-19-SC | Tampering | scripts/check-phase19.sh | high | mitigate | No package installs; analog detectors; --self-test plants failures |
</threat_model>