Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

facebook/pyrefly

              main @ e1a5187
            

Fixes

CVEs

HIGH

Peak severity

34.4%

Coverage

Highlights

Denial of Service: 38 prior fixes. Scrutinize any change in this area.

crates/pyrefly_util/src/lined_buffer.rs: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Recursive type evaluation and protocol conformance checks repeatedly trigger stack overflows due to missing recursion guards or cycle tracking during deep subtyping resolutions. This can be exploited to crash the compiler or the LSP server via complex self-referential definitions.

Denial of Service: Line-buffer manipulations and LSP position translations frequently panic when receiving out-of-bounds line offsets, invalid ranges, or non-code cells from the LSP client, bringing down the server connection.

Prompt Injection: The inclusion of automated AI commands like review-pr processing untrusted user contributions allowed malicious pull request content to inject instructions and hijack the Claude LLM flow.