Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

naibowang/easyspider

              master @ 676486b
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

CSRF: 1 prior fix. Scrutinize any change in this area.

ElectronJS/server.js: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Insecure system command construction during execution tasks on macOS and Linux platforms allows arbitrary shell command execution. This must be defended against by migrating all shell invocations to subprocess APIs with shell=False.

Code Injection: Dynamic field tokens executed within templates via eval() and JavaScript execution paths are susceptible to code injection via scraped webpage content. Dynamic execution must use safe parsers or strict sanitizers like repr() and json.dumps().

OS Command Injection: Executing shell utilities like taskkill or pidof via os.system exposes the system to command injection. Such flows must be entirely refactored to use native OS APIs or process signals.