Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jeecgboot/jimureport
master @ 9e3cb2d
3
Fixes
7
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
JimuReportTokenServiceImpl: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: The application permits insecure deserialization and arbitrary class loading via user-supplied parameters, such as H2 JDBC URLs and JNDI lookups, in connection-testing endpoints. Developers must rigorously validate connection strings and disable untrusted dynamic deserialization or remote JNDI lookups.
Auth Bypass: Overly permissive default security configurations (such as antMatchers().permitAll()) have previously exposed administrative and sharing endpoints, allowing unauthenticated privilege escalation. Strict, opt-in permission checks must be applied to all newly defined routes.
Path Traversal: An unauthenticated image download endpoint allowed arbitrary local file reads via the 'imageUrl' parameter. File access paths must be strictly canonicalized and restricted to a designated safe directory.