Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mamoe/mirai

              dev @ 283f884
            

Fixes

CVEs

CRITICAL

Peak severity

70.0%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

mirai-core: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recursive evaluation of parent nodes was missing, permitting callers to bypass checks that depended on inheritance. Developers should ensure nested hierarchies are fully resolved during permission lookups.

Sandbox Escape: Plugins could override core JVM classes within the custom class loader, breaking class-loader isolation constraints. Ensure that the delegating class loader prioritizes and protects JDK platform packages.

Path Traversal: Insufficent validation allowed accessing files outside designated directories. Path traversal mitigations must enforce path canonicalization paired with prefix checks.