diff --git a/.planning/phases/32-seo-foundation/32-REVIEW-DISPOSITION.md b/.planning/phases/32-seo-foundation/32-REVIEW-DISPOSITION.md index 348b43c4..1df22781 100644 --- a/.planning/phases/32-seo-foundation/32-REVIEW-DISPOSITION.md +++ b/.planning/phases/32-seo-foundation/32-REVIEW-DISPOSITION.md @@ -5,39 +5,39 @@ titles: json findings: - id: CR-01 severity: critical - disposition: open + disposition: fixed title: "[CR-A01] `required: true` on a form extension field makes every save of the host form fail (also for administrators who cannot see the extension)" - id: CR-02 severity: critical - disposition: open + disposition: fixed title: "[CR-A02] Plugin field-type upload route ignores the extension's Permissions/Visible, so administrators without them can run its `Upload`" - id: WR-01 severity: warning - disposition: open + disposition: fixed title: "[WR-A01] Admin writes that change or delete records fire no record event (hasMany link/unlink, deferred child unlink, deferred child commit)" - id: WR-02 severity: warning - disposition: open + disposition: fixed title: "[WR-A02] `RecordSaved.Locale` is the admin's UI language or the raw `Accept-Language` header, not a content locale, and reorder reports something different" - id: WR-03 severity: warning - disposition: open + disposition: skipped title: "[WR-A03] A failing extension `Load` (or plugin-type `Load`) after a successful save rolls back the whole save" - id: WR-04 severity: warning - disposition: open + disposition: fixed title: "[WR-A04] Journal API writes can commit changes (including a slug) and fire no RecordSaved" - id: WR-05 severity: warning - disposition: open + disposition: fixed title: "[WR-A05] Journal `postSavedEvent` reports `Old: nil` for a translated `content_html` that existed, because the body is mutated between the snapshot and the event" - id: WR-06 severity: warning - disposition: open + disposition: fixed title: "[WR-A06] Tags auto-created by the Journal post API fire no RecordSaved although `journal-tag` is now a content type" - id: WR-07 severity: warning - disposition: open + disposition: fixed title: "[WR-A07] `Hide` leaves the owner's relation-manager and partial endpoints of a hidden field reachable" - id: IN-01 severity: info @@ -65,55 +65,55 @@ findings: title: "[IN-A06] The extension's client assets are served to every administrator of the host form" - id: CR-03 severity: critical - disposition: open + disposition: fixed title: "[CR-B01] Exact redirects with a trailing slash or upper-case query characters never match at runtime" - id: WR-08 severity: warning - disposition: open + disposition: fixed title: "[WR-B01] A query-specific exact redirect is silently shadowed by the path-only rule" - id: WR-09 severity: warning - disposition: open + disposition: fixed title: "[WR-B02] `AddressChanged` writes redirects without validation or the loop simulation" - id: WR-10 severity: warning - disposition: open + disposition: fixed title: "[WR-B03] The save-time loop check races with concurrent writes" - id: WR-11 severity: warning - disposition: open + disposition: fixed title: "[WR-B04] Undo is not idempotent under concurrent requests" - id: WR-12 severity: warning - disposition: open + disposition: fixed title: "[WR-B05] Public resolve and 404 report answer 500 for NUL or invalid UTF-8 paths" - id: WR-13 severity: warning - disposition: open + disposition: fixed title: "[WR-B06] The runtime cycle log grows without bound and is keyed by attacker-controlled URLs" - id: WR-14 severity: warning - disposition: open + disposition: fixed title: "[WR-B07] Export with a large `page` panics the handler" - id: WR-15 severity: warning - disposition: open + disposition: fixed title: "[WR-B08] Public throttle buckets key on the SSR server's IP, capping the whole site" - id: WR-16 severity: warning - disposition: open + disposition: fixed title: "[WR-B09] Social image values bypass validation on every non-admin write path" - id: WR-17 severity: warning - disposition: open + disposition: fixed title: "[WR-B10] Invalid redirect status, match or query values are silently coerced on API, MCP and import" - id: WR-18 severity: warning - disposition: open + disposition: fixed title: "[WR-B11] `set_url_seo`, batch `set_seo` and the records import accept any locale" - id: WR-19 severity: warning - disposition: open + disposition: fixed title: "[WR-B12] Entry generation overwrites `entry.URL`, which can swallow an address change and its 301" - id: IN-07 severity: info @@ -149,31 +149,31 @@ findings: title: "[IN-B08] Self canonical and `url` are built from the decoded path" - id: CR-04 severity: critical - disposition: open + disposition: fixed title: "[CR-C01] The SERP preview and the robots.txt tester deadlock: their first action is dropped by the host and `inflight` is never cleared" - id: WR-20 severity: warning - disposition: open + disposition: fixed title: "[WR-C01] The social image preview accepts `/\\host/...`, so the admin can load an image from an attacker's host" - id: WR-21 severity: warning - disposition: open + disposition: fixed title: "[WR-C02] The CSV export/import round trip changes cells that already start with an apostrophe followed by a formula character" - id: WR-22 severity: warning - disposition: open + disposition: fixed title: "[WR-C03] The 404 \"Open/Resolved\" filter and the redirect \"Chains\" filter disagree with the runtime matcher" - id: WR-23 severity: warning - disposition: open + disposition: fixed title: "[WR-C04] The URL rule address is uncapped but sits in a btree UNIQUE index, so long values return 500 instead of 422" - id: WR-24 severity: warning - disposition: open + disposition: fixed title: "[WR-C05] The robots element's grammar drifts from the Go grammar, and an unparseable value is silently wiped on the next edit" - id: WR-25 severity: warning - disposition: open + disposition: fixed title: "[WR-C06] The element tests never exercise the host protocol; the tester and the image element have no tests" - id: IN-15 severity: info @@ -211,43 +211,43 @@ findings: severity: info disposition: open title: "[IN-C09] The `disabled` branches in the widget elements are dead, and would be broken if reached" -open: 52 +open: 23 total: 52 -recorded: 2026-10-27T13:31:50.257Z +recorded: 2026-10-27T14:47:23.755Z --- # Phase 32: Code Review Disposition | Finding | Severity | Disposition | Source | |---------|----------|-------------|--------| -| CR-01 | critical | open | - | -| CR-02 | critical | open | - | -| WR-01 | warning | open | - | -| WR-02 | warning | open | - | -| WR-03 | warning | open | - | -| WR-04 | warning | open | - | -| WR-05 | warning | open | - | -| WR-06 | warning | open | - | -| WR-07 | warning | open | - | +| CR-01 | critical | fixed | 32-REVIEW-FIX.md | +| CR-02 | critical | fixed | 32-REVIEW-FIX.md | +| WR-01 | warning | fixed | 32-REVIEW-FIX.md | +| WR-02 | warning | fixed | 32-REVIEW-FIX.md | +| WR-03 | warning | skipped | 32-REVIEW-FIX.md | +| WR-04 | warning | fixed | 32-REVIEW-FIX.md | +| WR-05 | warning | fixed | 32-REVIEW-FIX.md | +| WR-06 | warning | fixed | 32-REVIEW-FIX.md | +| WR-07 | warning | fixed | 32-REVIEW-FIX.md | | IN-01 | info | open | - | | IN-02 | info | open | - | | IN-03 | info | open | - | | IN-04 | info | open | - | | IN-05 | info | open | - | | IN-06 | info | open | - | -| CR-03 | critical | open | - | -| WR-08 | warning | open | - | -| WR-09 | warning | open | - | -| WR-10 | warning | open | - | -| WR-11 | warning | open | - | -| WR-12 | warning | open | - | -| WR-13 | warning | open | - | -| WR-14 | warning | open | - | -| WR-15 | warning | open | - | -| WR-16 | warning | open | - | -| WR-17 | warning | open | - | -| WR-18 | warning | open | - | -| WR-19 | warning | open | - | +| CR-03 | critical | fixed | 32-REVIEW-FIX.md | +| WR-08 | warning | fixed | 32-REVIEW-FIX.md | +| WR-09 | warning | fixed | 32-REVIEW-FIX.md | +| WR-10 | warning | fixed | 32-REVIEW-FIX.md | +| WR-11 | warning | fixed | 32-REVIEW-FIX.md | +| WR-12 | warning | fixed | 32-REVIEW-FIX.md | +| WR-13 | warning | fixed | 32-REVIEW-FIX.md | +| WR-14 | warning | fixed | 32-REVIEW-FIX.md | +| WR-15 | warning | fixed | 32-REVIEW-FIX.md | +| WR-16 | warning | fixed | 32-REVIEW-FIX.md | +| WR-17 | warning | fixed | 32-REVIEW-FIX.md | +| WR-18 | warning | fixed | 32-REVIEW-FIX.md | +| WR-19 | warning | fixed | 32-REVIEW-FIX.md | | IN-07 | info | open | - | | IN-08 | info | open | - | | IN-09 | info | open | - | @@ -256,13 +256,13 @@ recorded: 2026-10-27T13:31:50.257Z | IN-12 | info | open | - | | IN-13 | info | open | - | | IN-14 | info | open | - | -| CR-04 | critical | open | - | -| WR-20 | warning | open | - | -| WR-21 | warning | open | - | -| WR-22 | warning | open | - | -| WR-23 | warning | open | - | -| WR-24 | warning | open | - | -| WR-25 | warning | open | - | +| CR-04 | critical | fixed | 32-REVIEW-FIX.md | +| WR-20 | warning | fixed | 32-REVIEW-FIX.md | +| WR-21 | warning | fixed | 32-REVIEW-FIX.md | +| WR-22 | warning | fixed | 32-REVIEW-FIX.md | +| WR-23 | warning | fixed | 32-REVIEW-FIX.md | +| WR-24 | warning | fixed | 32-REVIEW-FIX.md | +| WR-25 | warning | fixed | 32-REVIEW-FIX.md | | IN-15 | info | open | - | | IN-16 | info | open | - | | IN-17 | info | open | - |