Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gorilla/csrf

              main @ 9dd6af1
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

CSRF: 3 prior fixes. Scrutinize any change in this area.

csrf.go: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: The CSRF protection layer could be bypassed during TLS sessions because validation relied on unpopulated URL scheme properties, necessitating strict verification of the HTTP Referer and Origin headers.

Auth Bypass: A vulnerability in token comparison allowed bypasses on older Go runtimes because subtle.ConstantTimeCompare did not implicitly guard against slice length mismatches, leading to potential timing or logical bypasses.

CSRF: Failure to propagate configured domain and path options to the underlying cookie store allowed CSRF session cookies to be sent over broader, unintended paths or subdomains.