sileya-ai
/
vr-shopxo-plugin
1
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases Wiki Activity
vr-shopxo-plugin/plan.md

80 lines
2.3 KiB
Markdown
Raw Normal View History

council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
# Council Plan — vr-shopxo-plugin 安全审议
council(draft): pm-reviewer - create plan.md with PM review task breakdown
2026-04-14 05:45:33 +00:00
council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
> Round 1 — 2026-04-15
> Branch: council/SecurityEngineer → main
> 状态：**Draft Phase**
council(draft): pm-reviewer - create plan.md with PM review task breakdown
2026-04-14 05:45:33 +00:00
---
council(draft): PM - Round 1 Q3 回答（配置结构建议） PM 立场：建议新增 `routing` section - routing.modelProviderOverride: 模型 → provider 映射 - routing.baseUrlOverride: 可选 baseUrl 覆盖 - 放在顶层，语义清晰，向后兼容 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:56:22 +00:00
## Task Summary
council(draft): resolve plan.md conflict, merge backend-reviewer + pm-reviewer plans Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-14 05:47:12 +00:00
council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
对 vr-shopxo-plugin 票务插件进行完整代码安全审议，输出独立评审报告（≥500字），列出所有发现的问题（严重/中等/轻微/建议），给出具体修复建议。**仅评论不改代码，变更提交本地 worktree。**
council(draft): pm-reviewer - create plan.md with PM review task breakdown
2026-04-14 05:45:33 +00:00
---
council(draft): PM - Round 1 Q3 回答（配置结构建议） PM 立场：建议新增 `routing` section - routing.modelProviderOverride: 模型 → provider 映射 - routing.baseUrlOverride: 可选 baseUrl 覆盖 - 放在顶层，语义清晰，向后兼容 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:56:22 +00:00
## Task Checklist
council(draft): pm-reviewer - create plan.md with PM review task breakdown
2026-04-14 05:45:33 +00:00
council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
- [ ] 1. 插件架构审计（EventListener.php / plugin.json）
- [ ] 2. 票务核心审计（TicketService.php / BaseService.php）
- [ ] 3. 前端票务详情页审计（ticket_detail.html）
- [ ] 4. 数据库 Schema 审计（如有 migrations）
- [ ] 5. 安全性综合审计（SQL注入/XSS/重放攻击/QR伪造）
- [ ] 6. 输出评审报告到 reviews/code-review-SecurityEngineer.md
- [ ] 7. 提交 plan.md 到 main
fix: 明确允许最小范围修改ShopXO源码（MIT协议），以进度为先
2026-04-14 06:10:59 +00:00
---
council(finalize): PM - Round 2 完成，清理 plan.md conflict markers - 清理 plan.md 中的 Git conflict markers - 确认 4 Q 全票通过 NON-BLOCKING - 架构决策完成 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:45:13 +00:00
## Phase Breakdown
council(draft): Architect - Round 1 架构评审结论 Q1: 座位模板绑定粒度 - NON-BLOCKING (分类UNIQUE KEY合理) Q2: spec_base_id_map - NON-BLOCKING (共用seat_map最简) Q3: 观演人存储 - NON-BLOCKING (vr_tickets支付后写入) Q4: spec绑定 - NON-BLOCKING ($vr-前缀隔离已确认) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:40:41 +00:00
council(draft): PM - Round 1 Q3 回答（配置结构建议） PM 立场：建议新增 `routing` section - routing.modelProviderOverride: 模型 → provider 映射 - routing.baseUrlOverride: 可选 baseUrl 覆盖 - 放在顶层，语义清晰，向后兼容 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:56:22 +00:00
| Phase | 内容 | 状态 |
|---|---|---|
council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
| **Draft** | 各模块代码审计 + 报告撰写 | ⏳ Pending |
| **Review** | 评审其他成员报告（如有） | ⏳ Pending |
council(draft): PM - Round 1 Q3 回答（配置结构建议） PM 立场：建议新增 `routing` section - routing.modelProviderOverride: 模型 → provider 映射 - routing.baseUrlOverride: 可选 baseUrl 覆盖 - 放在顶层，语义清晰，向后兼容 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:56:22 +00:00
| **Finalize** | 合并到 main，投票 | ⏳ Pending |
---
## Claim Status
| Task | Owner | Status |
council(finalize): PM - Round 2 完成，清理 plan.md conflict markers - 清理 plan.md 中的 Git conflict markers - 确认 4 Q 全票通过 NON-BLOCKING - 架构决策完成 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:45:13 +00:00
|---|---|---|
council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
| 插件架构审计 | council/SecurityEngineer | `[Claimed]` |
| 票务核心审计 | council/SecurityEngineer | `[Claimed]` |
| 前端票务页审计 | council/SecurityEngineer | `[Claimed]` |
| 数据库Schema审计 | council/SecurityEngineer | `[Claimed]` |
| 安全综合审计 | council/SecurityEngineer | `[Claimed]` |
| 输出评审报告 | council/SecurityEngineer | `[Claimed]` |
---
## 审计关注点清单
### 插件架构
- [ ] 生命周期钩子（Install/Uninstall/Enable/Disable）完整性
- [ ] 权限/菜单注册安全性
- [ ] 升级迁移策略
### 票务核心
- [ ] onOrderPaid() 并发安全（库存锁定/原子操作）
- [ ] verifyTicket() 核销鉴权（状态机完整性）
- [ ] AES QR 加密（密钥管理/IV/模式选择）
- [ ] 订单状态流转安全性
### 前端安全
- [ ] XSS 输出转义
- [ ] 表单 CSRF 防护
- [ ] 敏感信息暴露
### 数据库
- [ ] SQL 拼接风险点
- [ ] 参数化查询使用情况
- [ ] 索引覆盖完整性
### 支付安全
- [ ] 支付回调重放攻击（nonce/一次性token）
- [ ] 签名验证完整性
council(draft): Architect - Round 1 架构评审结论 Q1: 座位模板绑定粒度 - NON-BLOCKING (分类UNIQUE KEY合理) Q2: spec_base_id_map - NON-BLOCKING (共用seat_map最简) Q3: 观演人存储 - NON-BLOCKING (vr_tickets支付后写入) Q4: spec绑定 - NON-BLOCKING ($vr-前缀隔离已确认) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:40:41 +00:00
---
council(draft): SecurityEngineer - create plan.md for vr-shopxo-plugin security review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 01:14:23 +00:00
**[CONSENSUS: NO]** — Round 1 完成，进入执行轮