Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aliyun/aliyun-oss-java-sdk

              master @ c74012e
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

STSAssumeRoleSessionCredentialsProvider: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Checkpoint files loaded during download resume operations were deserialized using standard ObjectInputStream without restriction, allowing arbitrary object injection. Developers must use the restricted custom stream to enforce class allowlists.

Auth Bypass: A logic bug in AccessControlList.revokeAllPermissions failed to remove permissions because Grantee objects were compared directly to Grant objects, leaving grants active when they should have been revoked.

Auth Bypass: An object ACL specified during UploadFileRequest was not propagated to the CompleteMultipartUploadRequest, causing uploaded objects to fallback to default (potentially public) bucket permissions.