Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bytebase/dbhub

              main @ 4c390d5
            

Fixes

CVEs

HIGH

Peak severity

35.3%

Coverage

Highlights

Auth Bypass: 12 prior fixes. Scrutinize any change in this area.

src/connectors/manager.ts: most-fixed (3 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Brittle, AST-free SQL parsing and keyword validation allowed attackers to execute mutating write queries against read-only connections using comments, nested CTEs, and specific dialect tricks. Complete prevention requires enforcing native driver-level read-only modes in addition to query-level scanning.

Auth Bypass: Bypasses occurred when read-only modes configured in data sources (such as TOML files) were not propagated to or enforced by the database drivers, allowing clients to run destructive operations against supposedly read-only systems.

Auth Bypass: The application transport layer was vulnerable to DNS rebinding, which allowed external web origins to make unauthorized local HTTP/WebSocket requests and bypass API authorization mechanisms.