2 Commits

Include renames

Author	SHA1	Message	Date
BaaRai	e233c02314	Translate all Chinese text to English ... Comments, doc comments, UI labels, log and error messages, LLM prompt strings, markdown docs, test data and assertions. Identifiers, enum keys, routes, placeholders and code structure are unchanged. Notes: - docs/漏洞流量证据.md renamed to docs/vulnerability-traffic-evidence.md - tests that exercised CJK specific handling (GBK zip names, Chinese full text search) now use ASCII equivalents; go build passes and the test suite matches the pre translation baseline (remaining failures need a PostgreSQL DSN and fail identically on the original) - frontend mention syntax now uses English kinds (finding, asset, ...) matching the backend, chat mentions tests pass	2026-10-08 23:14:34 +02:00
Autumn-27	5825b3f80c	feat(intercept): 新增内置拦截规则「删除类接口路径」 ... 内置的 HTTP 破坏性规则只认 DELETE 方法（curl -X DELETE、requests.delete(、 method:'DELETE'），路径类规则的词表又只有 /clear /wipe /flush /purge /truncate /drop /destroy /factory-reset /reset-all。而多数应用的删除接口用 GET/POST 就能 触发，于是 `curl 'http://t/api/user/delete?id=1'` 不命中任何内置规则，会真实删掉 目标数据。 补一条 deny 规则覆盖 /delete /del /remove /unlink /erase /destroy，允许 /deleteAll、/delete_user、/delete-user 这类后缀形式（destroy 是重复覆盖：v1 那条 不允许后缀，/destroyAll 是漏的）。动词后强制跟分隔符，/delivery、/details、 /delta、/delegate 不会被误拦。 种子走独立标记位 intercept_default_rules_v3，已有实例升级后也会拿到——改 v1 的 字面量对老库无效（标记位已是 done）。插入带 WHERE NOT EXISTS 兜底，标记位丢失也 不会插重复。正则提为包级常量，配纯正则单测（不依赖 DB）覆盖命中与误伤两侧。	2026-09-30 04:12:57 -04:00