Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
django/channels
main @ 4188a65
3
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
channels/http.py: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Race Condition: Mutating shared class-instance state during concurrent request handling in the ASGI HTTP handler allowed request data to leak across different users' connections, leading to sensitive information disclosure (CVE-2020-35681).
Auth Bypass: An invalid urlparse usage with scheme=None in the OriginValidator could cause incorrect validation of allowed origins, potentially letting unauthorized WebSocket connections bypass origin checks.
HTTP Response Splitting: Improper output stripping on serialized Set-Cookie headers in the cookie middleware permitted leading whitespace, causing potential HTTP header parsing issues or response splitting.