fix(security): 收 #609 安全审计 — SSRF/prompt注入/history HMAC/QA信封 (F-01~F-06) - #617

Merged

appergb merged 9 commits into

betafrom

fix/issue-609-security-audit

Jun 8, 2026

Commits on Jun 7, 2026

fix(security): F-01 SSRF — LLM endpoint IP 段校验 + https 强制 (#609)
吕柏青
and
claude
committed
4cd8db6
fix(security): F-02 prompt 注入 — polish 信封多层加固 (#609)
吕柏青
and
claude
committed
4063efc
fix(security): F-06 QA 注入 — 选区原文包 XML 信封 (#609)
吕柏青
and
claude
committed
93830ff
fix(security): F-03 history HMAC 完整性 + F-04 0o600/at-rest 文档 (#609)
吕柏青
and
claude
committed
0765cb9
test(security): F-05 golden/snapshot prompt 测试 + qa/resources 纯函数单测 (#609)
吕柏青
and
claude
committed
b146f9f
fix(security): #609 双审收口（C-01 堵 legacy HMAC 绕过/H-01 Gemini SSRF 校验/H-02 常量时间/0o600 race/补测试）
吕柏青
and
claude
committed
4e65ce1
fix(security): F-01 收口 — ASR/provider 自定义 endpoint 也做 SSRF 校验 (#609)
吕柏青
committed
3342e42

Commits on Jun 8, 2026

fix(security): F-01 放宽 — RFC1918/ULA 局域网允许 http（支持 LAN 自托管），仍拦 169.254/CGNAT/公网 http (#609)
吕柏青
committed
0fd120a
fix(security): F-02 翻译路径补对抗式注入防御 (#609)
吕柏青
committed
972e7ff