Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
google/error-prone
master @ 1917d13
2
Fixes
0
CVEs
MEDIUM
Peak severity
50.0%
Coverage
Highlights
Bypass of Security Controls: 1 prior fix. Scrutinize any change in this area.
core/src/main/java/com/google/errorprone/bugpatterns/PrivateSecurityContractProtoAccess.java: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Bypass of Security Controls: Downstream applications can bypass critical XSS protections if they directly access underlying private protocol buffer builders instead of using designated safe HTML types. The static analysis checker must reliably block access to forbidden builder methods.
Trojan Source: Malicious actors can introduce bidirectional Unicode formatting characters to alter the visual representation of source code, misleading reviewers while executing arbitrary code. The compiler must intercept and ban these characters to maintain code integrity.