Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

esapi/esapi-java-legacy

              develop @ 58be169
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/main/java/org/owasp/esapi/reference/DefaultEncoder.java: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The canonicalization logic within DefaultEncoder could apply query-specific decoding logic globally to non-query URI segments, allowing attackers to bypass critical security validation checks or double-encoding guards.

Auth Bypass: Insecure legacy SQL encoding configurations could permit SQL injection bypasses, which ultimately required a strict opt-in configuration mechanism to safely restrict the behavior of the encodeForSQL API.

LDAP Injection: The encodeForLDAP and encodeForDN methods in DefaultEncoder failed to escape the forward slash ('/') character, which is critical for preventing LDAP injection attacks involving search filters and Distinguished Names.