Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

javaee/hk2

              master @ addaf4f
            

Fixes

CVEs

MEDIUM

Peak severity

12.5%

Coverage

Highlights

Sandbox Escape: 4 prior fixes. Scrutinize any change in this area.

hk2: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Critical reflective operations (like setAccessible) and dynamic proxy generation (using Enhancer.create) were executed without privileged blocks, risking sandbox bypasses when running under restrictive J2SE SecurityManagers. Developers must systematically wrap reflection, proxying, and classloading in AccessController.doPrivileged.

Privilege Escalation: Direct calls to System.getProperty without doPrivileged wrapping trigger AccessControlException or SecurityException in restricted sandboxes. Developers must enforce privileged wrapping for all system property lookups.

Sandbox Escape: Retrievals of classloaders (getClassLoader and getContextClassLoader) were invoked outside of privileged action blocks, leading to permission isolation failures. All classloader lookups must be executed inside AccessController.doPrivileged blocks.