Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
go-resty/resty
v3 @ b5060b2
6
Fixes
1
CVEs
HIGH
Peak severity
83.3%
Coverage
Highlights
Information Disclosure: 4 prior fixes. Scrutinize any change in this area.
middleware.go: most-fixed (3 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Critical header leakage occurs when sensitive HTTP request headers are forwarded during redirection. This risk is compounded by incomplete host-matching logic (e.g., stripping ports during comparisons or failing to properly isolate cross-domain boundaries), exposing credentials to third parties.
Path Traversal: The file-saving middleware previously trusted user-supplied 'Content-Disposition' headers directly, allowing attackers to write arbitrary files outside the targeted directory through directory traversal sequences.
Race Condition: Concurrent request processing and reuse of shared resources like sync.Pool and un-cloned header structures can lead to cross-request data leaks and race conditions, exposing request bodies or headers to concurrent threads.