15 lines
1.0 KiB
JSON
15 lines
1.0 KiB
JSON
{
|
|
"feature_id": "F-058",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "No new attack surface. listByProductIds is parameterised via pg's parameterised query (ANY($1::uuid[])). UUIDs come from the trusted products table, not from user input. Frontend change only swaps one dead prop for an existing API field. No auth boundary change.",
|
|
"evidence": [
|
|
"listByProductIds uses parameterised query with productIds typed as uuid[] — no SQL injection vector",
|
|
"Auth on /catalog/products unchanged: still requires admin role (requireRole(user, 'admin'))",
|
|
"Auth on /products/search unchanged: public endpoint, returns the same data shape that was already exposed (just with the actual images instead of empty array)",
|
|
"No new env vars, secrets, or external calls",
|
|
"Path traversal on the dynamic thumbnail URL is mitigated at the dynamic /uploads/[...path] handler with regex validation (covered by F-056)",
|
|
"git diff shows zero touches outside the catalog module and the admin products page"
|
|
],
|
|
"timestamp": "2026-08-19T13:50:00Z"
|
|
} |