Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/incubator-kie-optaplanner

              main @ d8c7e2f
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Deserialization of Untrusted Data: 2 prior fixes. Scrutinize any change in this area.

optaplanner-examples: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Unsafe XStream configuration processing permits arbitrary object deserialization through benchmark and solution XML files. This is remediated by shifting configurations or removing insecure annotations.

XML External Entity (XXE): XML configuration parsers and solution importers (like SAXBuilder and raw XStream readers) were susceptible to external entity expansion, leading to local file disclosure. These are mitigated by shifting to secure JAXB structures and explicitly disabling entity expansion.

CSRF: Using generic RequestMapping on state-changing endpoints allows them to accept unauthorized HTTP methods, increasing CSRF risks. This was resolved by restricting mappings to GetMapping.