Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

baidu/amis

              master @ 43a33ee
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Cross-Site Scripting (XSS): 5 prior fixes. Scrutinize any change in this area.

packages/amis-editor/src/renderer/FormulaControl.tsx: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Unsafe innerHTML updates allowed bypasses of security controls, requiring the implementation of a consistent React Context-based sanitization wrapper. Failure to use this wrapper on dynamic HTML content exposes applications to DOM-based XSS.

Cross-Site Scripting (XSS): The iframe renderer allowed execution of arbitrary code via malicious URIs. If iframe source URLs do not strictly block 'javascript:' schemes, attackers can execute code within the context of the hosting page.

Cross-Site Scripting (XSS): Formula rendering directly inserts HTML strings into the DOM via dangerouslySetInnerHTML. Without pre-rendering sanitation and output encoding, formula validation screens are vulnerable to script injection.