Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
farm-fe/farm
main @ 2000ef8
4
Fixes
50
CVEs
CRITICAL
Peak severity
Highlights
Denial of Service: 2 prior fixes. Scrutinize any change in this area.
packages/core/src/server/ws.ts: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Origin Validation Bypass: A missing origin validation check in the HMR WebSocket server allowed remote websites visited by a developer to interact with the local development server, risking code theft. This was resolved by validating the Origin header on incoming connection requests.
Denial of Service: The server proxy middleware's upgrade handler was susceptible to an infinite loop denial of service when local WebSocket proxy routes overlapped with HMR pathways, exhausting server capacity.
Denial of Service: On Windows platforms, base64 decoding of long file paths triggered an unhandled panic due to the unsafe use of unwrap(), resulting in localized command-line tool crashes.