Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

blockscout/blockscout

              master @ f7039b5
            

Fixes

CVEs

HIGH

Peak severity

44.1%

Coverage

Highlights

Denial of Service: 22 prior fixes. Scrutinize any change in this area.

apps/block_scout_web/lib/block_scout_web/views/smart_contract_view.ex: most-fixed (4 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Manual raw SQL string construction in database query functions allows direct SQL injection. Future developments must enforce parameterized Ecto queries using Ecto fragments rather than raw string concatenation.

SSRF: Fetching remote NFT token metadata from arbitrary user-provided URIs exposed the internal network to Server-Side Request Forgery. Strict validation against local network blocks and allowlisting of IPFS/HTTP schemes are necessary.

Stored XSS: Unsanitized output rendering of smart contract getter return values allows malicious contract owners to store and execute arbitrary JavaScript in explorer visitor browsers. All values rendered from contract ABI calls must be explicitly escaped.