Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lbryio/lbry-sdk

              master @ e7666f4
            

Fixes

CVEs

HIGH

Peak severity

78.1%

Coverage

Highlights

Denial of Service: 15 prior fixes. Scrutinize any change in this area.

lbry.extras.daemon.daemon: most-fixed (2 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The JSON-RPC API historically relied on inconsistent method-level decorators, creating gaps where critical actions like channel creation and wallet decryption could be executed without authentication. Global enforcement is required.

Path Traversal: Stream downloads and descriptor unpacking are vulnerable to directory traversal if the suggested file and directory names are not sanitized with strong regular expressions prior to file system operations.

Auth Bypass: Improper exception handling during signature verification and certificate resolution can result in validating claims signed by expired, modified, or entirely unverified channels.