Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cocoapods/cocoapods-downloader
master @ e685164
7
Fixes
2
CVEs
HIGH
Peak severity
Highlights
Command Injection: 6 prior fixes. Scrutinize any change in this area.
lib/cocoapods-downloader/git.rb: most-fixed (4 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Attackers can inject shell metacharacters and argument flags through untrusted git options and paths when commands are executed using unparameterized shell backticks. Ensure target directories and option arguments are converted to strings, validated, and passed using parameterized APIs rather than raw backticks.
Command Injection: Insufficient input validation at the download phase allows malicious repository URLs or Mercurial parameters to execute arbitrary commands. Centralized validation must occur on all download paths to ensure command-line options and URLs cannot be manipulated to pass arbitrary flags.
Local Code Execution: Running git clone on arbitrary repositories can trigger local code execution through malicious git hooks contained in the repository. The downloader must explicitly suppress hook execution by appending safe templates directory flags.