Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

securitybunker/databunker

              master @ 8ca8817
            

Fixes

CVEs

CRITICAL

Peak severity

35.7%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

src/consent_api.go: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: String-interpolated and concatenated database helper functions in the QLDB adapter allowed arbitrary SQL injection during queries, inserts, deletes, and updates. This was mitigated by migrating to parameterized query arguments.

Auth Bypass: Consent endpoints suffered from authorization bypasses due to missing access controls, unvalidated record lookups, and unvalidated format parameters. Enforcing strict existence validation and authorization checks is crucial on all consent API pathways.

Auth Bypass: Defects in session creation and response handling could allow authorization bypasses by returning incorrect session identifiers or failing to use parameter-provided session tokens.