Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
openbazaar/openbazaar-desktop
master @ f724cf1
7
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Reflected XSS: 3 prior fixes. Scrutinize any change in this area.
js/views/search/Search.js: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Stored XSS: User-submitted markdown or HTML in listing descriptions can lead to stored XSS if not thoroughly sanitized before being rendered or edited by other users. This is particularly dangerous in the desktop client where the application may run with elevated privileges.
Reflected XSS: Query parameters and responses processed from external decentralized search providers were previously rendered without adequate escaping, allowing malicious providers to inject executing scripts into the client context.
Auth Bypass: Improper validation and routing of external payment addresses (such as ShapeShift integrations) can allow attackers to bypass intended currency boundaries or redirect funds.