Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

joemccann/dillinger

              master @ 17010b7
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Reflected XSS: 3 prior fixes. Scrutinize any change in this area.

public/js/dillinger.js: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A critical session-leak flaw existed where Dropbox SDK interactions relied on shared singleton state mutation rather than session-isolated context. This allowed concurrent users to potentially hijack or write data to other users' active Dropbox accounts. Developers must avoid mutating singleton wrappers and instead pass session-scoped tokens explicitly per request.

Reflected XSS: Multiple instances of Reflected XSS occurred due to 'marked' HTML sanitization being disabled or incorrectly toggled off. Even when client-side controls were restored, they were prone to regressions across separate code paths and export modules. Ensuring sanitization is globally enabled and enforced in the markdown library config is paramount.

Credential Exposure: OAuth consumer secrets and API keys for third-party integrations (Github, Dropbox) were hardcoded and committed into the codebase inside configuration and backup folders, risking total compromise of identity provider trust. Secrets must reside exclusively in environment variables.