Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
angular-fullstack/generator-angular-fullstack
master @ 48769d6
17
Fixes
0
CVEs
HIGH
Peak severity
46.2%
Coverage
Highlights
Auth Bypass: 10 prior fixes. Scrutinize any change in this area.
app/templates/server/api/user(auth)/user.model(mongooseModels).js: most-fixed (2 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Lack of schema validation on blank/missing email and password fields, combined with unreturned mongoose pre-save hook calls, allows critical authentication flows to bypass state verification and execute database updates without validation.
Auth Bypass: Faulty flow control in passport third-party OAuth setups (Facebook and Google) permits execution to continue and establish active sessions even when database save operations fail or return errors.
Information Disclosure: Serializing mongoose model objects without proper database projections exposed sensitive parameters (e.g., password hashes) due to filtering for 'password' instead of 'hashedPassword'.