Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gogf/gf

              master @ fb89f8b
            

Fixes

CVEs

CRITICAL

Peak severity

30.8%

Coverage

Highlights

CORS Misconfiguration: 3 prior fixes. Scrutinize any change in this area.

net/ghttp: most-fixed (7 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The serving of static files and downloadeables previously used flawed path resolution logic, allowing directory traversal. Ensure all path parsing uses canonicalization with strict boundary validation against the server root.

CORS Misconfiguration: Flawed origin validation relying on substring extraction, raw response header extraction, or string-index carving from Referer/Origin headers allows attackers to bypass cross-origin restrictions. Rely only on robust URL parsing and exact scheme/host matching.

Auth Bypass: A logic bug in BasicAuth fell through to returning true, letting unauthenticated requests pass. Ensure all authentication handlers explicitly return failures in default or unhandled switch-case branches.