Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
sinelaw/fresh
master @ 96178ca
48
Fixes
2
CVEs
HIGH
Peak severity
35.0%
Coverage
Highlights
Denial of Service: 27 prior fixes. Scrutinize any change in this area.
crates/fresh-editor/src/services/workspace_trust.rs: most-fixed (3 issues). Treat as high-risk during review.
15 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application failed to isolate sensitive workspace trust contexts, allowing automatic environment activation, toolchain execution, and LSP spawning in untrusted repositories. Explicit authorization gates are required to prevent malicious code execution.
Auth Bypass: Sensitive remote backends, LSP servers, and process spawners were globally shared across window/session boundaries, allowing untrusted local workspaces to inherit the permissions or credentials of a trusted remote context.
Path Traversal: Untrusted plugins and file operations could bypass directory boundaries to read, write, or delete arbitrary files on the host filesystem if path canonicalization and prefix checks were omitted.