Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mozilla/hawk
main @ c1dd59b
6
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
lib/crypto.js: most-fixed (3 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flaws in request MAC calculations, such as utilizing client-supplied payload hashes or unkeyed SHA hashes rather than verifying actual payload integrity using the client secret key, directly undermine the core authentication guarantees of the Hawk protocol.
Auth Bypass: Weak regex-based parsing of Host headers allows bypasses when resolving request identities. Standard, hardened URL parsing is required to prevent malformed host headers with embedded path components from escaping validation boundaries.
ReDoS: Unbounded regular expression matching on HTTP headers and incoming resource URLs can lead to exponential computation times, causing severe service availability issues unless strict length limits are applied.