Back to Details

code-review

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

.NET Code Review

.NET代码审查

Trigger On

触发场景

reviewing a pull request or patch in a .NET repository
checking for behavioral regressions, API misuse, or missing tests
auditing architectural or framework-specific correctness

审查.NET代码仓库中的拉取请求（pull request）或补丁
检查行为回归、API误用或缺失的测试
审核架构或框架相关的正确性

References

参考资料

checklist.md - comprehensive code review checklist organized by risk priority
patterns.md - common patterns and anti-patterns for async, disposal, and security

checklist.md - 按风险优先级整理的全面代码审查清单
patterns.md - 异步、资源释放和安全相关的常见模式与反模式

Workflow

工作流程

Prioritize correctness, data loss, concurrency, security, lifecycle, and platform-compatibility issues before style concerns. Use the checklist P0-P2 categories first.
Check async flows, cancellation propagation, exception handling, disposal, and transient versus singleton lifetime mistakes. Refer to patterns.md for common pitfalls.
Verify tests cover the changed behavior, not only the happy path or refactored implementation details.
Inspect framework-specific boundaries such as EF query translation, ASP.NET middleware order, Blazor render state, or MAUI UI-thread access.
Call out missing observability, migration risk, or runtime configuration drift when those are part of the change.
Keep findings concrete, reproducible, and tied to specific files or behavior.

在关注代码风格之前，优先处理正确性、数据丢失、并发、安全、生命周期和平台兼容性问题。首先使用清单中的P0-P2分类。
检查异步流程、取消令牌（CancellationToken）传播、异常处理、资源释放，以及瞬态与单例生命周期的错误。参考patterns.md了解常见陷阱。
验证测试是否覆盖了变更后的行为，而不仅仅是正常路径或重构后的实现细节。
检查框架特定的边界情况，例如EF查询转换、ASP.NET中间件顺序、Blazor渲染状态或MAUI UI线程访问。
当变更涉及可观测性缺失、迁移风险或运行时配置偏移时，需指出这些问题。
确保审查结果具体、可复现，并关联到特定文件或行为。

Key Review Patterns

核心审查模式

Async Code

异步代码

Async must propagate through the entire call chain; never use
```
.Result
```
,
```
.Wait()
```
, or
```
.GetAwaiter().GetResult()
```
in async contexts
Always propagate
```
CancellationToken
```
parameters
Use
```
ConfigureAwait(false)
```
in library code
Never use
```
async void
```
except for event handlers

异步必须在整个调用链中传播；绝不能在异步上下文中使用
```
.Result
```
、
```
.Wait()
```
或
```
.GetAwaiter().GetResult()
```
始终传播
```
CancellationToken
```
参数
在库代码中使用
```
ConfigureAwait(false)
```
除事件处理程序外，绝不要使用
```
async void
```

Resource Disposal

资源释放

Use
```
using
```
declarations or statements for all
```
IDisposable
```
resources
Use
```
await using
```
for
```
IAsyncDisposable
```
resources
Use
```
IHttpClientFactory
```
instead of creating
```
HttpClient
```
directly
Unsubscribe event handlers to prevent memory leaks
Validate DI service lifetimes to prevent captured dependencies

对所有
```
IDisposable
```
资源使用
```
using
```
声明或语句
对
```
IAsyncDisposable
```
资源使用
```
await using
```
使用
```
IHttpClientFactory
```
而非直接创建
```
HttpClient
```
取消事件订阅以防止内存泄漏
验证DI服务生命周期，避免捕获依赖项

Security

安全

Use parameterized queries or EF to prevent SQL injection
Validate all user input at system boundaries
Prevent path traversal by validating resolved paths stay within allowed directories
Never hardcode secrets; use configuration and secret management
Enforce authorization checks before accessing protected resources

使用参数化查询或EF防止SQL注入
在系统边界验证所有用户输入
通过验证解析后的路径是否在允许目录内，防止路径遍历攻击
绝不要硬编码密钥；使用配置和密钥管理工具
在访问受保护资源前强制执行授权检查

Deliver

交付成果

ranked review findings with file references
clear residual risks and test gaps
brief summary of what changed only after findings

带有文件引用的分级审查结果
明确的剩余风险和测试缺口
仅在列出审查结果后提供变更内容的简要总结

Validate

验证要求

findings describe user-visible or maintainability-impacting risk
assumptions are stated when repo context is incomplete
no trivial style nit hides a more serious issue

审查结果需描述用户可见或影响可维护性的风险
当仓库上下文不完整时，需说明假设条件
不要让琐碎的风格问题掩盖更严重的问题