Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

filecoin-project/slate

              main @ 1c654c6
            

Fixes

CVEs

CRITICAL

Peak severity

75.0%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

node_common/upload.js: most-fixed (3 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Upload operations have been highly susceptible to resource and connection exhaustion, requiring multiple fixes to enforce limits on file sizes, remaining bucket space, concurrency queue limits, and stream timeouts.

Auth Bypass: Allowing users to specify target usernames or identities directly in request bodies instead of enforcing session cookies has led to direct authorization bypasses.

Auth Bypass: Using mutable identifiers such as usernames in JWT/session tokens rather than immutable user database IDs exposes the application to account takeover via username recycling.