Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rails/webpacker

              master @ a715e05
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

README.md: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Loose regex matching on path parameters in DevServerProxy allowed routing unintended requests to the internal development server. This can lead to unauthorized access to internal development resources via Rack::Proxy.

SSRF: The project historically documented and promoted the use of a webpack-dev-server version vulnerable to DNS Rebinding and SSRF (CVE-2018-14732).

Information Disclosure: Default production Webpack configurations exposed original source code files in public builds due to permissive source-map generation settings, requiring a change to 'nosources-source-map'.