patrickandClaude Sonnet 5
0d524fc714
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
CI / Web (dms-browser) (pull_request) Canceled after 0s
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
CI / Web (shl) (pull_request) Canceled after 0s
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Fable-5.1-Vergleichsreview: die Positivlisten-Pruefung lief bisher nur gegen die vom Client bei StartUpload angekuendigte Typangabe (validate.go ValidateMimeType); ein als "application/pdf" deklariertes, tatsaechlich beliebiges Archiv/Binary wurde erst beim spaeteren Ausliefern per Magic-Bytes erkannt (documentapi/handler.go), nicht vor der Aufnahme. Fix: Complete() liest die ersten 512 Bytes aus dem Staging-Reader, prueft sie per http.DetectContentType gegen dieselbe Positivliste, BEVOR Verschluesselung/Storage/DB-Eintrag passieren. Der Praefix wird fuer Pruefsumme/Verschluesselung wieder vorangestellt (kein Byteverlust). Echter Testlauf auf Host 204 gegen migrierte Testdatenbank: go test ./internal/upload/... -v -> 12/12 PASS, davon neu: TestCompleteUpload_ContentMismatchingDeclaredMimeTypeIsRejected (ZIP-Inhalt mit deklariertem application/pdf wird jetzt abgelehnt). Ausserdem go build ./... fuer das gesamte dms-Modul lief fehlerfrei durch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>