Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
danieleteti/delphimvcframework
master @ 04c2d8a
19
Fixes
0
CVEs
HIGH
Peak severity
44.4%
Coverage
Highlights
Auth Bypass: 10 prior fixes. Scrutinize any change in this area.
MVCFramework.JWT.pas: most-fixed (3 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent JWT validation, incorrect handling of expiration checks, and standard instead of URL-safe Base64 parsing have repeatedly led to complete signature-verification and authorization bypasses.
Path Traversal: The internal static file-serving components failed to correctly isolate resources, allowing directory traversal attacks unless canonical paths were strictly validated against a fully-qualified document root prefix.
Cryptographic Issues: Incorrect timezone-aware epoch evaluations (using local time instead of strict UTC) and algorithmic bypasses where developer-defined signature keys/algorithms were ignored can lead to predictability in token expiration and validation.