[Review] Daily Deep Review — 2026-05-09: Repo stale 27 days, no new activity

[evan-zhang11]

Daily Repository Deep Review — 2026-05-09

Summary

No new commits since 2026-04-12 (27 days stale). Last push was 2026-04-27 (Dependabot PR updates only).

CI Status — Still Broken

All PRs fail backend_fmt and frontend_unit. This has been the case since ~April 12 (tracked in #223).

Affected PRs (8 open):

• chore(deps): bump resvg from 0.44.0 to 0.47.0 #234 (resvg 0.47.0) — fmt + frontend_unit fail
• chore(deps): bump sha2 from 0.10.9 to 0.11.0 #233 (sha2 0.11.0) — fmt + frontend_unit fail
• chore(deps): bump the cargo-minor-patch group with 9 updates #232 (cargo minor-patch) — fmt + frontend_unit + tests + e2e + postgis fail
• chore(deps): bump the npm-minor-patch group across 1 directory with 10 updates #216 (npm minor-patch) — CI status unknown but likely same pattern
• chore(deps): bump rust from 1.94-slim-bookworm to 1.95-slim-bookworm #215 (Rust 1.95 Docker) — CI status unknown
• chore(deps): bump softprops/action-gh-release from 2 to 3 #214 (action-gh-release v3) — CI status unknown
• feat: 从服务器导入文件（引用模式） #173 (file import) — merge conflicts, stale
• chore(deps): bump tower-sessions from 0.14.0 to 0.15.0 #65 (tower-sessions) — long-standing blocker

Code Quality Status (unchanged)

File	Lines	Issue
db.rs	1763	#244
import.rs	1584	#241
App.jsx	2111	#230
workspace_handlers.rs	1259	#229
handlers.rs	1626	#227
font_handlers.rs	790	—
icon_handlers.rs	460	—
upload.rs	256	—

Security (unchanged, all tracked)

• [安全] Critical SQL Injection Vulnerability in Feature Properties Query #194: SQL injection (critical) — dynamic SQL in handlers.rs uses format! with column/table names
• security: SVG icon served inline enables stored XSS #237: SVG stored XSS — icons served as image/svg+xml
• [安全] SVG 上传潜在的 XXE (XML External Entity) 攻击向量 #218: SVG XXE attack vector
• [安全] DefaultBodyLimit::disable() 全局禁用请求体大小限制 #219: DefaultBodyLimit::disable() globally
• security: 4 npm vulnerabilities — Vite path traversal, picomatch ReDoS, postcss XSS, proto pollution #240: 4 npm vulnerabilities (Vite path traversal, picomatch ReDoS, postcss XSS, proto pollution)

New Observations

1. handlers.rs SQL building (lines 706-709): Column names are double-quoted in format strings (format!("\"{normalized}\"")), which prevents basic SQL injection but relies on normalization being correct. The table name in line 709 is also double-quoted. This is adequate but not ideal — parameterized identifiers would be safer.

2. db.rs has 72 .expect() calls: Most are in schema initialization which is acceptable (fail-fast on startup), but worth noting for robustness.

3. PR chore(deps): bump the cargo-minor-patch group with 9 updates #232 (cargo minor-patch, 9 updates) fails postgis + tests + e2e: This suggests breaking changes in dependency updates. Needs investigation when CI is fixed.

Priority Recommendations

1. 🔴 Fix CI (fix: main branch CI broken — cargo fmt and biome check failures since 2026-04-12 #223, ci: cargo fmt fails on font_handlers.rs and icon_handlers.rs (rustfmt line-length enforcement) #238) — This blocks everything. Run cargo fmt and fix biome/frontend_unit locally, push to main.
2. 🔴 SQL injection ([安全] Critical SQL Injection Vulnerability in Feature Properties Query #194) — Critical, should be addressed ASAP
3. 🟡 SVG security (security: SVG icon served inline enables stored XSS #237, [安全] SVG 上传潜在的 XXE (XML External Entity) 攻击向量 #218) — Serve SVG with Content-Disposition: attachment or sanitize
4. 🟡 Dependency updates — Once CI is fixed, merge the minor-patch PRs
5. 🟢 Code modularization — code-quality: db.rs grown to 1763 lines — connection management, migrations, and utilities should be split into modules #244, code-quality: import.rs grown to 1584 lines — OGC_FID workaround logic should be extracted #241, code-quality: App.jsx grown to 2111 lines (was 612) — needs splitting #230, code-quality: workspace_handlers.rs at 1259 lines — needs module split #229, code-quality: handlers.rs grown to 1626 lines (was 882) — needs splitting #227

No New Issues Filed

All findings are already tracked. No new code to review.