Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

httpie/cli

              master @ 5b604c3
            

Fixes

CVEs

CRITICAL

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

httpie/ssl.py: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

TLS Verification Bypass: Custom SSL context creation silently bypassed user-configured verification requirements (verify=True), allowing potential man-in-the-middle (MitM) attacks on secure communication streams.

Auth Bypass: HTTPie sessions failed to restrict headers and cookies to their target hosts, allowing sensitive authentication state to leak to arbitrary third-party servers.

TLS/SSL Configuration: String-based SSL version specifications were not correctly resolved to their constant equivalents during custom context creation, potentially degrading transport security.