Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

django/django

              main @ e789914
            

342

Fixes

CVEs

CRITICAL

Peak severity

23.1%

Coverage

Highlights

Denial of Service: 89 prior fixes. Scrutinize any change in this area.

django.contrib.auth: most-fixed (11 issues). Treat as high-risk during review.

76 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Dictionary expansion and custom column aliases in QuerySet methods (such as filter, exclude, annotate, and alias) historically allowed SQL injection via unescaped control characters, hashes, or invalid connector strings. Developers must strictly validate aliases and logical connector types before compilation.

Denial of Service: HTML-stripping and utility filters like strip_tags, urlize, and urlizetrunc have recurringly suffered from infinite loops or CPU exhaustion when processing very long inputs or nested, incomplete HTML sequences. String boundaries, input length checks, and depth limitations are vital when parsing raw HTML.

Path Traversal: Path traversal and file manipulation risks recur in archive extraction, custom file storage backends, and multipart file parsers. File name normalization must rigorously canonicalize path separators, restrict non-printable characters, and verify that target paths strictly reside under expected directories using os.path.commonpath.