Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cyu/rack-cors
master @ f73bcd3
12
Fixes
2
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
lib/rack/cors.rb: most-fixed (10 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Path validation and canonicalization failures allowed attackers to bypass configured resource constraints and gain unauthorized cross-origin access to restricted paths, as detailed in CVE-2019-18978.
Origin Validation Bypass: Missing regular expression anchors during origin matching allowed malicious subdomains or similarly-named domains to bypass origin checks and issue cross-origin requests, as seen in CVE-2017-11173.
Insecure CORS Policy: Allowing credentials to be shared with wildcard origins ('*') can expose sensitive session data to arbitrary third-party origins.