15 lines
1.3 KiB
JSON
15 lines
1.3 KiB
JSON
{
|
|
"feature_id": "F-138",
|
|
"agent": "security",
|
|
"stage": "security_gate",
|
|
"verdict": "APPROVED",
|
|
"summary": "Seed SQL is fully parameterized: variantId passed via $1 placeholder (it is a UUID produced by variants.create, never raw user input). The default values (net=0, offer=NULL, cost=NULL, vat_rate='general') are code constants, not user input — no SQL injection surface. ON CONFLICT DO NOTHING guarantees idempotency and prevents duplicate-key errors. The seed is wrapped in try/catch inside the use-case so a seed failure cannot roll back or fail the primary variant creation.",
|
|
"checks": [
|
|
{"item": "SQL parameterization", "ok": true, "evidence": "PgPricingRepository.seedVariantPrice uses $1 placeholder with params tuple [variantId]"},
|
|
{"item": "no string concatenation of user input into SQL", "ok": true, "evidence": "net_unit_amount_cents=0, offer_cents=NULL, cost_cents=NULL, vat_rate='general' are literal constants"},
|
|
{"item": "no new user-facing SQL path introduced", "ok": true, "evidence": "seedVariantPrice is an internal post-create step; no new public route or query parameter"},
|
|
{"item": "pre-existing R1 (security.routes.ts:14 → log-broadcaster) not introduced by F-138", "ok": true, "evidence": "git diff: security.routes.ts line 14 (log-broadcaster import) is untouched by F-138"}
|
|
],
|
|
"issues": []
|
|
}
|