Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rest-sh/restish

              main @ 6e904ce
            

Fixes

CVEs

HIGH

Peak severity

24.1%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

internal/auth/oauth_authcode.go: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The application discovers and interacts with external OIDC issuer endpoints. Failure to properly restrict requests to the target host and canonical path scopes can leak sensitive authentication tokens to untrusted third parties.

Path Traversal: Extraction and removal of command plugins are susceptible to directory traversal. Missing path canonicalization or failure to restrict archive members to flat base names allows writing or removing arbitrary files on the local filesystem.

Argument Injection: Spawning local system browsers to complete the OAuth authorization flow with user-controlled or remote URLs is vulnerable to command and argument injection on both Unix and Windows systems. This requires explicit argument separators and escaping.