NixMsg

[H-01][medium] 管理接口请求体大小与读取时间不受限制，公开的登录接口可被打爆内存 P2-medium lane/admin review-2026-09-30

#44

by nixevol was closed 2026-09-30 16:36:08 +08:00

1

[U-05][low] 目录搜索的 LIKE 通配符没有转义；端编号 inline 与 mochi 内联客户端同名 P3-low lane/identity review-2026-09-30

#43

by nixevol was closed 2026-09-30 16:36:07 +08:00

1

[U-04][medium] 锁定计数表从不清理，轮换 IP 可让内存持续增长 P2-medium lane/identity review-2026-09-30

#42

by nixevol was closed 2026-09-30 16:36:07 +08:00

1

[U-03][medium] 对话密码锁定不一致：按对计数键三处各不相同、锁定期内不带密码也报 rate_limited、后台改对话密码与删除端不清锁定 P2-medium lane/identity review-2026-09-30

#41

by nixevol was closed 2026-09-30 16:36:06 +08:00

1

[U-02][medium] 群操作的校验不在写事务里；建群输入不去重；后台建群不校验群主 P2-medium lane/identity review-2026-09-30

#40

by nixevol was closed 2026-09-30 16:36:05 +08:00

1

[U-01][high] 开启自助注册时不要求安全码，空安全码即可注册 P1-high lane/identity lane/web review-2026-09-30

#39

by nixevol was closed 2026-09-30 16:36:05 +08:00

1

[C-07][low] 消息校验与小问题合集：ttl 可为 0 或负数、delay 溢出变立即发送、提交不检查发送方已停用、群分发不按入群时间过滤、保留期按创建时间算 P3-low lane/message review-2026-09-30

#38

by nixevol was closed 2026-09-30 16:36:04 +08:00

1

[C-06][medium] 推送时 meta 里的数字被转成 float64，超过 2^53 的整数被静默篡改 P2-medium lane/message review-2026-09-30

#37

by nixevol was closed 2026-09-30 16:36:04 +08:00

1

[C-05][medium] 每端请求限速只作用于 send，撤回、状态、目录、群、unlock 等请求都不限速 P2-medium lane/message review-2026-09-30

#36

by nixevol was closed 2026-09-30 16:36:03 +08:00

1

[C-04][high] 退群、踢人、解散、停用、删除作废投递时不写回执、不收尾：消息永远停在 dispatched、正文不删、占发送方配额 P1-high lane/message review-2026-09-30

#35

by nixevol was closed 2026-09-30 16:36:03 +08:00

1

[C-03][high] 保留清理放在每秒循环里：全表扫描、单事务大删除、到期处理无 LIMIT、没有 wal_checkpoint；断线清标记 SQL 缺条件；僵尸不保留投递永不过期 P1-high lane/message review-2026-09-30

#34

by nixevol was closed 2026-09-30 16:36:02 +08:00

2

[C-02][high] 回执没有在途标记：每次推送都重发最早 64 条未确认回执，并发时必然重复，第 65 条起可能永远发不出 P1-high lane/message review-2026-09-30

#33

by nixevol was closed 2026-09-30 16:36:01 +08:00

2

[C-01][high] 推送与调度循环重构：握手前就推送、同端并发推送、单协程串行循环被慢操作冻结、到点分发每秒最多 100 条 P1-high lane/message review-2026-09-30

#32

by nixevol was closed 2026-09-30 16:36:00 +08:00

2

[D-05][low] 存储、配置与构建小问题合集：迁移失败反复全量备份、版本号未注入、显式 0 被改回默认、命令行改管理员密码不作废会话 P3-low lane/store review-2026-09-30

#31

by nixevol was closed 2026-09-30 16:36:00 +08:00

1

[D-04][medium] 备份与恢复不安全：库不存在时静默新建空库并报成功，恢复步骤没要求清理 -wal/-shm P2-medium lane/store review-2026-09-30

#30

by nixevol was closed 2026-09-30 16:35:59 +08:00

1

[D-03][medium] 读连接池没有上限且只保留 2 个空闲连接：群发或批量唤醒时出现 SQLite 连接风暴 P2-medium lane/store review-2026-09-30

#29

by nixevol was closed 2026-09-30 16:35:59 +08:00

2

[D-02][medium] 写队列关闭不安全且缺少非事务执行接口：停机时可能 panic，清理后无法执行 wal_checkpoint P2-medium lane/store review-2026-09-30

#28

by nixevol was closed 2026-09-30 16:35:58 +08:00

1

[D-01][medium] 写队列 busy 状态一旦置位就永不恢复，/readyz 永久返回 503 P2-medium lane/store review-2026-09-30

#27

by nixevol was closed 2026-09-30 16:35:57 +08:00

1

[L-07][low] 监听与 HTTP 小问题合集：XFF 解析可伪造、每连接新建 tls.Config、/metrics 令牌非常量时间比较、重复创建 listener P3-low lane/listener review-2026-09-30

#26

by nixevol was closed 2026-09-30 16:35:57 +08:00

1

[L-06][medium] 健康检查只会明文：配了证书并关闭明文时必失败，Docker 示例配置因此默认开着明文 P2-medium lane/listener review-2026-09-30

#25

by nixevol was closed 2026-09-30 16:35:56 +08:00

1