Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
looly/hutool
v5-master @ a0bd223
4
Fixes
15
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
hutool-jwt: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The JWT implementation suffered from authentication bypass vulnerabilities where the 'none' algorithm was not properly restricted, letting attackers bypass signature validation checks even when a verification key or signer was configured. Subsequent fixes implemented stricter header verification prior to key processing.
Remote Code Execution: Untrusted input could trigger critical JNDI injection via javax.naming.InitialContext or lead to expression language evaluation exploits. Mitigations required strict restriction of environment protocols and enforcing sandbox boundaries like SimpleEvaluationContext for SpEL.
Cryptographic Issues: A critical logic error in default HMAC key generation substituted weak HmacMD5 key material when callers requested stronger algorithms like HMac-SHA1 or HMac-SHA256, compromising transit integrity and token security.