Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opf/openproject

              dev @ fea7f71
            

353

Fixes

CVEs

CRITICAL

Peak severity

36.4%

Coverage

Highlights

Auth Bypass: 167 prior fixes. Scrutinize any change in this area.

app/controllers/account_controller.rb: most-fixed (6 issues). Treat as high-risk during review.

115 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The platform has historically suffered from recurrent SSRF issues where validators and outbound HTTP clients (such as HTTPX, Net::HTTP, and Faraday) failed to securely restrict local and IPv6 addresses. Ensure all outgoing requests use verified address resolvers that bind early to validated IP targets.

Auth Bypass: API-based account changes historically bypassed current password confirmation checks, allowing potential account takeovers. Contracts must consistently require current password verification on critical user profile updates.

Path Traversal: Path traversal during file operations (such as BCF XML exports) occurred when user-controlled identifiers (like viewpoint GUIDs) were joined directly into file paths. Ensure strict regex format validation on all file-system joined parameters.