Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

shardingjdbc/sharding-jdbc

              master @ 42834fc
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

distribution/mcp: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The DistSQL workflow engine previously allowed execution of unvalidated database rules or unapproved execution steps. Attackers could bypass governance controls by submitting crafted rules that skip preview states or explicit approval validations.

SQL Injection: User-supplied identifiers (database, schema, table, column) were interpolated directly into statement execution paths without adequate validation or sanitization, potentially allowing arbitrary SQL commands to be executed via the workflow planning process.

Information Disclosure: Secret references and sensitive placeholders in generated workflow artifacts were previously exposed or processed without mask protections, leading to potential leakages of sensitive database credentials or internal parameters during workflow evaluation.