Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
salesforce/tough-cookie
master @ 6f6ae90
7
Fixes
3
CVEs
HIGH
Peak severity
71.4%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
lib/cookie/cookieJar.ts: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Using standard JavaScript objects for indexing parsed cookie domains allows malicious inputs (such as '__proto__') to corrupt the global Object prototype, which can lead to remote code execution or application-wide denial of service.
Auth Bypass: Validating context using strict 'instanceof URL' checks fails across different execution environments (e.g. VMs or isolated contexts), causing valid objects to reject and disrupting correct cookie isolation policies.
Auth Bypass: Failing to restrict cookie sharing across private domains registered under public suffixes (e.g. herokuapp.com) allows sibling subdomains to read or overwrite each other's session cookies, exposing clients to session hijacking.