Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/ant

              master @ 4a30f9b
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

src/main/org/apache/tools/ant/DirectoryScanner.java: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: DirectoryScanner failed to properly handle Windows NTFS directory junctions, treating them as normal directories instead of symbolic links. This allowed file operations to cross boundaries and access files outside of the configured base directory, which could lead to unauthorized file deletion or modification.

Path Traversal: PermissionUtils resolved and followed symbolic links when retrieving file attributes via Files.readAttributes, exposing the application to symlink-chasing attacks where target files are manipulated during the permissions check.

Insecure Temporary File Creation: Insecure handling of temporary files in local directories (such as java.io.tmpdir) within the fixcrlf and replaceregexp tasks allowed local attackers to inject malicious code or modify source files during compilation processes.