Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sakaiproject/sakai

              master @ 611af7b
            

Fixes

CVEs

HIGH

Peak severity

85.7%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

kernel/api/src/main/java/org/sakaiproject/util/Xml.java: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Null-pointer conditions in user identification checks within permission evaluation logic can bypass intended authorization checks. Developers must ensure strict null safety on identity objects before verifying authorization.

XML External Entity (XXE): Insecure XML parser configurations can leave the application open to XXE and DoS attacks (Billion Laughs). Hardening parser factories by explicitly disabling external DTDs and entities is critical.

Path Traversal: Decompressing user-supplied archives (such as SCORM packages) without enforcing path canonicalization can lead to directory traversal out of the destination directory.