Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

shrinkwrap/resolver

              master @ c004015
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Insecure Transport: 1 prior fix. Scrutinize any change in this area.

maven/impl-maven-embedded/src/main/java/org/jboss/shrinkwrap/resolver/impl/maven/embedded/FileExtractor.java: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The FileExtractor was vulnerable to a Zip Slip path traversal during archive extraction. An attacker supplying a malicious dependency could write arbitrary files to the filesystem by escaping the target directory during unpacking. Developers should ensure all extraction paths are validated using canonicalization and prefix checks.

Insecure Transport: The resolver utilized an unencrypted HTTP URL for the default Maven Central repository, exposing the build system to potential Man-in-the-Middle (MITM) attacks. This allowed active attackers to intercept, manipulate, or inject malicious payloads into resolved dependencies during build-time execution.