WenPai-org/wpmind
WenPai-org/wpmind
3
0
Fork 0
Code Pull requests Projects Releases 2 Packages Activity Actions
wpmind/modules/api-gateway/includes/Auth
History
Exact
LinuxJoy 36b69d300d security: API Gateway 全量代码审计修复 (59 issues) 
Codex 审计发现 124 个问题，修复 59 个 P0-P2 级别问题：

P0 (CRITICAL):
- TOCTOU 竞态: TransientRateStore/SseConcurrencyGuard 改用 wp_cache_add 原子锁
- REST 路由: __return_true → check_bearer_present 轻量鉴权
- Schema 验证: messages/tools/tool_choice 添加完整 validate_callback
- SQL 列名不匹配: upsert 查询对齐 SchemaManager 定义
- SQL 表名插值: 统一使用 %i 占位符

P1 (HIGH):
- IP hash 加盐 (HMAC) + IP 解析统一 (context 共享)
- Header 注入防护 (X-Request-Id/响应头 \r\n 过滤)
- 数值参数范围校验 (temperature/top_p/penalties/max_tokens)
- insert_key 错误处理 + revoke_key 审计日志
- Pipeline finally 保护 + RateLimiter rollback 双 store
- wp_unslash 补全 + strtotime 返回值检查
- RedisRateStore $rid 冒号验证
- UpstreamStreamClient catch \Throwable

P2 (MEDIUM):
- AuditLogRepository DRY (提取 build_where_clause)
- Token 估算 CJK 优化 (mb_strlen)
- ResponseTransformMiddleware null 检查
- 嵌入响应 usage 数据修复
- SchemaManager autoload 优化

25 files changed, ~530 insertions, ~190 deletions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-09 01:14:12 +08:00
..
ApiKeyAuthResult.php feat: API Gateway Phase 0-3 — 模块骨架 + Auth 子系统 + 中间件框架 2026-02-08 20:20:59 +08:00
ApiKeyHasher.php feat: API Gateway Phase 0-3 — 模块骨架 + Auth 子系统 + 中间件框架 2026-02-08 20:20:59 +08:00
ApiKeyManager.php fix: API Gateway Codex 审查修复 — 6 个问题 2026-02-08 23:12:38 +08:00
ApiKeyRepository.php security: API Gateway 全量代码审计修复 (59 issues) 2026-02-09 01:14:12 +08:00