Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

0xmassi/webclaw

              main @ 0453c94
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

SSRF: 3 prior fixes. Scrutinize any change in this area.

.github/workflows/release.yml: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: SSRF is the most frequent vulnerability class in the project history, stemming from inadequate validation of DNS-resolved IP addresses, redirect targets, and private network ranges during fetch operations.

Command Injection: Running arbitrary user-supplied watch scripts via shell interpreters creates shell execution hazards. Safe execution requires argument tokenization using safe parsers like shlex instead of passing raw strings to shell processes.

Path Traversal: Exporting scraped data or URLs to files based on user-supplied parameters can allow directory traversal outside the target output directory unless paths are canonicalized and restricted to an allowed prefix path.