Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

arcsin1/oh-my-ppt

              main @ 0159edf
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Path Traversal: 3 prior fixes. Scrutinize any change in this area.

src/main/ipc/speech/speech-handlers.ts: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: This component handles speech script and slide generation via Electron IPC. Weak path validation previously allowed arbitrary file reads on the local filesystem using `fs.promises.readFile`. Multiple fixes were required to ensure paths are properly normalized, absolute, and reside within the active project directory.

Cross-Site Scripting (XSS): Unvalidated style packages previewed in the renderer context could result in XSS and unauthorized local file access. The fix required a combination of path canonicalization, iframe sandboxing, and HTML/CSS sanitization using Cheerio in the rendering components.