69 lines
3.1 KiB
JSON
69 lines
3.1 KiB
JSON
{
|
|
"feature_id": "DASH-REMOVE-VARIANTS-CARD",
|
|
"verdict": "APPROVED",
|
|
"agent": "security",
|
|
"security": "security",
|
|
"reviewed_at": "2026-08-27T21:28:40Z",
|
|
"scope": [
|
|
"project/apps/admin/src/app/(dashboard)/page.tsx"
|
|
],
|
|
"summary": "Pure UI removal. Cero impacto en superficie de seguridad: sin cambios en auth, sin cambios en CORS, sin cambios en cookies, sin nuevos endpoints, sin nuevas queries SQL, sin eval/source/dangerouslySetInnerHTML. Eliminar cards reduce ligeramente la superficie visible (menos hrefs salientes, menos rutas accesibles desde el dashboard). Aprobado.",
|
|
"checks": [
|
|
{
|
|
"id": "no-auth-change",
|
|
"description": "Sin cambios en auth",
|
|
"command": "git diff project/apps/admin/src/app/(dashboard)/page.tsx | grep -iE 'auth|login|cookie|token|session'",
|
|
"result": "PASS",
|
|
"evidence": "Sin matches. El dashboard sigue usando la misma sesión backoffice que ya tenía."
|
|
},
|
|
{
|
|
"id": "no-xss-regression",
|
|
"description": "Sin nuevos vectores XSS",
|
|
"command": "git diff project/apps/admin/src/app/(dashboard)/page.tsx | grep -E 'dangerouslySetInnerHTML|innerHTML|eval\\('",
|
|
"result": "PASS",
|
|
"evidence": "Sin matches. Renderiza texto vía {label}, {value}, {sub}, {icon} que React escapa automáticamente. Sin HTML crudo."
|
|
},
|
|
{
|
|
"id": "no-new-hrefs",
|
|
"description": "Solo se eliminan hrefs (no se añaden)",
|
|
"command": "git diff project/apps/admin/src/app/(dashboard)/page.tsx | grep -E 'href='",
|
|
"result": "PASS",
|
|
"evidence": "Solo aparecen los hrefs eliminados (los de los cards variants). Cero hrefs nuevos."
|
|
},
|
|
{
|
|
"id": "no-cors-change",
|
|
"description": "Sin cambios en CORS/headers/cookies",
|
|
"command": "git diff project/ | grep -iE 'cors|access-control|set-cookie|headers'",
|
|
"result": "PASS",
|
|
"evidence": "Sin matches. La config CORS del proyecto no se tocó."
|
|
},
|
|
{
|
|
"id": "no-secrets",
|
|
"description": "Cero secretos",
|
|
"command": "git diff project/ | grep -iE 'password|secret|token|api[_-]?key' | grep -v test",
|
|
"result": "PASS",
|
|
"evidence": "Sin matches."
|
|
},
|
|
{
|
|
"id": "no-new-deps",
|
|
"description": "Cero nuevas dependencias",
|
|
"command": "git diff --name-only -- '*package.json'",
|
|
"result": "PASS",
|
|
"evidence": "Sin cambios en package.json."
|
|
},
|
|
{
|
|
"id": "reduced-attack-surface",
|
|
"description": "Reducción ligera de superficie de ataque",
|
|
"command": "code review",
|
|
"result": "PASS",
|
|
"evidence": "Se eliminan 2 hrefs (`/inventory` como 'Revisar inventario' implícito y el de la card Sin stock). Cero nuevas rutas accesibles. Marginal positivo para security."
|
|
}
|
|
],
|
|
"findings": [],
|
|
"verdict_rationale": "Remoción pura de UI sin implicaciones de seguridad. Surface reduction mínima pero en la dirección correcta. APPROVED.",
|
|
"evidence_paths": [
|
|
"work/artifacts/DASH-REMOVE-VARIANTS-CARD/implementer.md",
|
|
"work/artifacts/DASH-REMOVE-VARIANTS-CARD/reviewer.json",
|
|
"project/apps/admin/src/app/(dashboard)/page.tsx"
|
|
]
|
|
} |