code-reviewer

代码审查员

生成任何输出之前，请先阅读 config/defaults.md，并根据用户配置的技术栈调整所有模式、导入内容和代码示例。

审查流程

1. 阅读范围内的所有文件（指定文件、PR 差异或项目）
2. 根据以下审查类别分析每个文件
3. 按严重级别输出结构化的问题
4. 提供可执行的修复建议

审查类别

安全性

注入漏洞

// BAD: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized query
const user = await prisma.user.findUnique({ where: { id: userId } });

XSS（跨站脚本攻击）

// BAD: Rendering unsanitized HTML
<div dangerouslySetInnerHTML={{ __html: userContent }} />

// GOOD: Sanitize or use text content
<div>{sanitizeHtml(userContent)}</div>
// Or just render as text
<div>{userContent}</div>

身份验证信息泄露

// BAD: Exposing sensitive data
return NextResponse.json({ user: { ...user, password: user.password } });

// GOOD: Exclude sensitive fields
const { password, ...safeUser } = user;
return NextResponse.json({ user: safeUser });

硬编码密钥

// BAD
const API_KEY = 'sk-1234567890abcdef';

// GOOD
const API_KEY = process.env.API_KEY;

路径遍历

// BAD: User-controlled file path
const filePath = `./uploads/${req.query.filename}`;

// GOOD: Validate and sanitize
const filename = path.basename(req.query.filename);
const filePath = path.join('./uploads', filename);

性能

N+1 查询

请参阅 prisma-query-optimizer 技能，了解检测模式。

内存泄漏

// BAD: Event listener not cleaned up
useEffect(() => {
  window.addEventListener('resize', handleResize);
}, []);

// GOOD: Cleanup on unmount
useEffect(() => {
  window.addEventListener('resize', handleResize);
  return () => window.removeEventListener('resize', handleResize);
}, []);

无界操作

// BAD: Loading all records
const allUsers = await prisma.user.findMany();

// GOOD: Paginate
const users = await prisma.user.findMany({ take: 50, skip: offset });

同步文件 I/O

// BAD: Blocks event loop
const data = fs.readFileSync('large-file.json');

// GOOD: Async I/O
const data = await fs.promises.readFile('large-file.json');

可维护性

魔法数字

// BAD
if (status === 3) { ... }

// GOOD
const STATUS_COMPLETED = 3;
if (status === STATUS_COMPLETED) { ... }

// BETTER: Use enum or const object
const Status = { COMPLETED: 3 } as const;

嵌套过深

// BAD: Arrow code
if (user) {
  if (user.isActive) {
    if (user.hasPermission('write')) {
      // ...
    }
  }
}

// GOOD: Early returns
if (!user) return;
if (!user.isActive) return;
if (!user.hasPermission('write')) return;
// ...

上帝函数

超过 50 行或参数超过 5 个的函数应拆分。

死代码

未使用的导入、return/throw 后不可达的代码、注释掉的代码块。

命名规范

命名不一致

// BAD: Mixed styles
const user_name = '...';
const userEmail = '...';
const UserAge = 25;

// GOOD: Consistent camelCase for variables
const userName = '...';
const userEmail = '...';
const userAge = 25;

名称不明确

// BAD
const d = new Date();
const arr = users.filter(u => u.a);

// GOOD
const createdAt = new Date();
const activeUsers = users.filter(user => user.isActive);

错误处理

吞掉错误

// BAD: Silent failure
try {
  await saveData();
} catch (e) {
  // Nothing
}

// GOOD: Log or handle
try {
  await saveData();
} catch (error) {
  console.error('Failed to save:', error);
  throw error; // Or handle appropriately
}

通用 catch

// BAD: Catches everything including programming errors
try {
  doSomething();
} catch (e) {
  return defaultValue;
}

// GOOD: Catch specific errors
try {
  doSomething();
} catch (error) {
  if (error instanceof NetworkError) {
    return defaultValue;
  }
  throw error;
}

测试覆盖缺口

未测试的边界情况

标记处理以下情况的函数：

• 未经测试的 null/undefined 输入
• 未经测试的空数组/对象
• 未经测试的错误情况
• 未经测试的边界值

缺少集成测试

API 路由和数据库操作应有集成测试。

输出格式

## Code Review Report

### Critical (must fix before merge)
| Severity | File | Line | Issue | Category |
|----------|------|------|-------|----------|
| CRITICAL | src/api/users.ts | 45 | SQL injection vulnerability | Security |

**Details:**
- Issue: User input directly interpolated into query string
- Fix: Use parameterized queries via Prisma
```typescript
// Before
const query = `SELECT * FROM users WHERE email = '${email}'`;

// After
const user = await prisma.user.findUnique({ where: { email } });

警告（应修复）

严重程度	文件	行	问题	类别
WARNING	src/hooks/useData.ts	23	useEffect 中缺少清理逻辑	性能

提示（建议）

严重程度	文件	行	问题	类别
INFO	src/utils/format.ts	12	魔法数字应定义为命名常量	可维护性

摘要

• 严重：X 个问题
• 警告：X 个问题
• 提示：X 个问题
• 已审查文件：X

## Severity-Based Prioritization

After completing the review, sort all findings by severity. If any critical security issue is found, prepend a prominent warning at the top of the output: `⚠ CRITICAL SECURITY ISSUE — address before anything else.` Do not bury critical findings in a long list of minor style suggestions. If there are more than 15 findings, group by severity and show only critical + warning by default, with info-level findings in a collapsed section.

## Reference

See `references/review-checklist.md` for the complete review criteria organized by category.