Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
getzola/zola
master @ 4b438c6
9
Fixes
1
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Denial of Service: 4 prior fixes. Scrutinize any change in this area.
src/cmd/serve.rs: most-fixed (7 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Insecure handling of user-controlled request paths allows directory traversal outside the public web root. Ensuring absolute canonicalization matched against the root directory prefix is critical to prevent arbitrary file disclosure.
Path Traversal: File helper functions executed within template rendering can escape the Zola project sandbox if paths are not canonicalized and checked against a strict base directory constraint.
Denial of Service: The local development server is prone to panics during standard operations such as parsing bind addresses, resolving missing file extensions in watcher events, and canonicalizing non-existent directories. Replacing unwrap calls with robust error propagation prevents service crashes.