Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
languagetool-org/languagetool
master @ 369d695
29
Fixes
1
CVEs
HIGH
Peak severity
30.8%
Coverage
Highlights
Denial of Service: 17 prior fixes. Scrutinize any change in this area.
languagetool-core: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flaws in JWT token verification and decoding allowed users with invalid signatures to bypass premium tier restrictions and access premium APIs. Standardizing try-catch wrapping around token operations is critical to preventing validation bypasses.
XML External Entity (XXE): XML parsers used to load grammar, patterns, and false-friend rule files failed to disable external DTD resolution, exposing the system to potential server-side file disclosure and internal network scanning via malicious rule sets.
Denial of Service: Unbounded regular expression evaluation, recursive tokenizer calls, and unconstrained token index lookups across multiple language modules routinely triggered StackOverflowError, IndexOutOfBoundsException, and CPU exhaustion.