Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

open-source-legal/opencontracts

              main @ 341ad4b
            

441

Fixes

CVEs

CRITICAL

Peak severity

43.6%

Coverage

Highlights

Auth Bypass: 242 prior fixes. Scrutinize any change in this area.

config/graphql/mutations.py: most-fixed (38 issues). Treat as high-risk during review.

182 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Widespread occurrence of BOLA / IDOR across various mutations and query fields due to missing or custom-disabled validation rules, direct model lookups bypassing visibility filters, and nested connection resolver leaks.

SSRF: The outbound request client was historically vulnerable to private network and CGNAT IP address bypasses (e.g., via IPv4-mapped IPv6 formats, empty resolver lists, or redirects) before centralizing validations into safe HTTP helpers.

Path Traversal: Imported ZIP archives and worker-supplied file names lacked robust path canonicalization and directory-prefix checking, permitting arbitrary file write and traversal attacks during extraction.