Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mvanhorn/cli-printing-press
main @ a264fd5
32
Fixes
0
CVEs
HIGH
Peak severity
29.0%
Coverage
Highlights
Information Disclosure: 14 prior fixes. Scrutinize any change in this area.
internal/generator/templates/client.go.tmpl: most-fixed (5 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Generated client components historically leaked sensitive authorization headers (such as X-API-Key) and custom authentication cookies to external third parties during HTTP redirects. This was mitigated by restricting the re-stamping of headers to same-host requests and stripping cookies on cross-host hops.
SQL Injection: The SQLite storage engine templates previously allowed raw SQL injection. Attackers could manipulate query parameters via unvalidated path components in Store.ResolveByName or raw SQLite resource types in Store.ListIDs to execute arbitrary SQL commands.
Path Traversal: The publishing and archive pipelines are vulnerable to directory traversal via malicious symlinks and parameter injections (such as using directory traversal sequences inside the category parameter). This allows files to be written or read outside of the intended staging and source trees.