Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

polkadot-js/apps

              master @ c3550cf
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

packages/apps-electron/src/electron/contentSecurityPolicy.ts: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The UI signature verification component historically accepted unsupported or 'none' crypto signature types as valid. This creates an authentication bypass where invalid signatures can visually appear verified. Developers must ensure 'signatureVerify' checks explicitly reject fallback or unverified schemes.

Auth Bypass: Critical transaction submit buttons ('TxButton') could remain clickable even when validation rules failed, allowing users to attempt unauthorized or invalid controller account states. Guard checks must dynamically disable the submission elements using the absolute 'isFatal' state.

CSP Injection: Loose script-src hashes or overly permissive local developer host bindings in the Electron context expose the desktop application to execution of untrusted scripts. Tightening the policy to specific verified hashes is mandatory.