Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rightnow-ai/openfang

              main @ acf2587
            

Fixes

CVEs

HIGH

Peak severity

26.7%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

crates/openfang-api/src/routes.rs: most-fixed (5 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The authentication middleware had multiple critical flaws, including an empty-string check bypass on untrimmed API keys, missing authorization on hand endpoints, and a failure to restrict unauthenticated public endpoints to safe HTTP methods. Developers must ensure all paths default to strict validation with explicit opt-outs.

SSRF: WASM host networking functions bypasses allowed requests to cloud metadata and bracketed IPv6 formats due to diverging implementation logic from the main web fetcher. Unified SSRF filters must be applied universally across both runtime hosts and api routers.

Denial of Service: API routes are susceptible to crashes and memory exhaustion due to unsafe string slicing across UTF-8 boundaries and a lack of character size limits on config parameters. Implementing a centralized length and boundary safe validation layer is essential.