Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mozilla/rhino
master @ 1057a83
16
Fixes
1
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Sandbox Escape: 8 prior fixes. Scrutinize any change in this area.
JavaPolicySecurity.java: most-fixed (1 issue). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Generated Java adapter classes can inherit the highly privileged ProtectionDomain of the Rhino engine itself rather than the restricted caller context, leading to a complete sandbox escape if not mitigated via stack analysis and explicit domain propagation.
Privilege Escalation: Security controllers designed to execute actions with specific permissions can be bypassed if the generated bytecode templates (such as SecureCaller) or dynamic loaders are not strictly validated, isolated, or properly structured with default super constructors.
Sandbox Escape: Cached reflection members of Java classes can leak across security contexts. If the security context is not explicitly incorporated into the cache key, restricted scripts can reuse cached members resolved under highly privileged contexts.