Security context

Highlights

Auth Bypass: 31 prior fixes. Scrutinize any change in this area.

backend/app/api/v1/file.go: most-fixed (7 issues). Treat as high-risk during review.

61 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Insecure middleware ordering and route registration allowed unauthenticated bypass of critical routes, such as registering static handlers or proxy paths before auth checks. Client-side IP spoofing also degraded loopback and trusted proxy validation.

Command Injection: String-interpolated system command execution and insufficient character validation allowed bypass of shell metacharacter filters. Attackers exploited characters like '<' or '>' to write files and execute remote code.

Path Traversal: Generic file endpoints allowed direct retrieval and writing of local system files due to a lack of canonicalization and directory prefix verification.