Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

google/closure-compiler

              master @ de0bd96
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

src/com/google/javascript/jscomp/ConformanceRules.java: most-fixed (7 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Bypass of Security Controls: AST analysis of tagged template literals failed to evaluate banned string patterns when uncookable escape sequences caused 'getCookedString()' to return null, allowing security policies to be bypassed silently.

Auth Bypass: Type-matching logic in conformance rules failed to account for nullable or optional types (e.g., Type|null), causing subtype checks to miss calls to banned elements and secure APIs.

Deserialization of Untrusted Data: The presence of an unsafe Java deserialization entry point via ObjectInputStream.readObject in CompilerOptions exposed the compiler to arbitrary remote code execution.