Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
shurcool/issues
main @ 5ed542b
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
fs.go: most-fixed (3 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical modification endpoints (Edit, EditComment, Create, CreateComment) historically lacked core authentication and authorization checks, allowing unauthorized creation or modification of issues and comments.
Auth Bypass: Flawed authorization logic queried incorrect permission APIs (GetPermissions instead of Auth.Identify) to determine user capabilities, resulting in potential bypasses of the `canEdit` guard.
Auth Bypass: Collapsing different operations (editing comment text vs. toggling a reaction) under a single authorization path led to weak access controls; distinct actions require isolated checks (like `canEdit` and `canReact`).