Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

c9s/bbgo

              main @ bd9fbc3
            

Fixes

CVEs

HIGH

Peak severity

41.2%

Coverage

Highlights

Denial of Service: 8 prior fixes. Scrutinize any change in this area.

pkg/bbgo/session.go: most-fixed (4 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Command routing bypassed verification entirely, enabling unauthenticated users to trigger privileged operations using public interactive commands. Developers must enforce strict state checks before executing dynamically dispatched commands.

Auth Bypass: Shared session state and insufficient isolation in Telegram interactive handlers allowed unauthorized messages and inter-user session pollution. Isolation patterns must utilize dedicated per-user maps.

Denial of Service: Recursive JSON structures led to infinite recursion and stack overflow panics when unmarshaling exchange sessions. Type aliasing or custom unmarshal recursion limits are necessary.