Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jhipster/generator-jhipster

              main @ a8892a4
            

143

Fixes

CVEs

HIGH

Peak severity

51.3%

Coverage

Highlights

Auth Bypass: 68 prior fixes. Scrutinize any change in this area.

app/templates/src/main/java/package/config/_SecurityConfiguration.java: most-fixed (13 issues). Treat as high-risk during review.

61 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Misconfigured request matchers (such as AntPathRequestMatcher) historically allowed attackers to bypass authentication routing rules. Transitioning to MvcRequestMatcher resolves ambiguity in path resolution patterns.

SQL Injection: Reactive templates generating SQL repositories for Spring WebFlux applications failed to sanitize raw criteria within conditions, leading to SQL Injection (CVE-2022-24815). The fix requires proper escape/quote wrapping of non-Long primary key identifier strings.

CSRF: WebSocket handlers skipped origin validation and did not mandate CSRF checks when using session authentication, leaving endpoints vulnerable to cross-site origin hijacking. Enabling WebSocket security and forcing XSRF-TOKEN verification on connection handshake mitigates the issue.