Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
serenity-is/serenity
master @ b9fffac
51
Fixes
1
CVEs
HIGH
Peak severity
57.9%
Coverage
Highlights
Auth Bypass: 13 prior fixes. Scrutinize any change in this area.
packages/corelib/src/base/validator.tsx: most-fixed (3 issues). Treat as high-risk during review.
32 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A logic inversion in ServiceAuthorizeAttribute allowed unauthenticated/unauthorized requests while blocking authorized users, breaking endpoint security across the framework. Developers must verify that negative checks do not inadvertently invert authentication gates.
Path Traversal: Path traversal vulnerabilities in CombinedUploadStorage and file handlers allowed directory traversal because sub-paths were validated without proper trailing slash boundaries or canonicalization, allowing attackers to write or delete arbitrary system files.
Open Redirect: Incomplete validation of redirect targets in LoginPage allowed attackers to craft malicious URLs leading to external domains, manifesting as CVE-2024-26318. Centralized helper validation should always be used rather than parsing redirect routes locally.