Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gorilla/sessions
main @ bb4cd60
4
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
CSRF: 2 prior fixes. Scrutinize any change in this area.
sessions.go: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The FilesystemStore allowed directory traversal when resolving session IDs, which could permit an attacker to read, write, or delete arbitrary files on the system using manipulated session identifiers. Developers must guarantee that all storage drivers sanitize paths and enforce strict prefix containment.
CSRF: Failure to propagate configured SameSite session options to the physical HTTP cookie structures meant that session cookies were transmitted on cross-site requests, leaving downstream web applications vulnerable to CSRF.
HTTP Response Splitting: Insufficient validation of cookie names allowed non-token characters to be processed, risking HTTP header injection or response splitting during cookie emission. Strict RFC 2616 character validation is required.