Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

a-h/templ

              main @ f8e3a1b
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

cmd/templ/generatecmd/proxy/proxy.go: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Dynamic attributes such as href can accept user-controlled values, risking execution of arbitrary javascript: URIs if template generation does not enforce sanitization. developers must verify that URL attributes are strictly sanitized using safe wrappers.

Auth Bypass: The development proxy inserts hot-reload script tags into HTML response bodies; if the Content Security Policy (CSP) nonce is not extracted and propagated to these script tags, the policy is bypassed or broken.

Denial of Service: Parsing Go expressions from template source code without prior bounds validation can trigger out-of-range slice indexing panics, crashing the parsing utility.