Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
siyuan-note/siyuan
master @ 96dfe0b
173
Fixes
50
CVEs
CRITICAL
Peak severity
23.7%
Coverage
Highlights
Path Traversal: 39 prior fixes. Scrutinize any change in this area.
kernel/model/session.go: most-fixed (16 issues). Treat as high-risk during review.
73 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The application serves files and exports assets via HTTP endpoints that historically lacked validation boundaries, permitting attackers to traverse outside the designated workspace to retrieve arbitrary files like sensitive configurations. Normalization must be done before evaluating directory prefixes.
Auth Bypass: Flaws in the request authorization middleware allowed requests to bypass crucial security checks. Suffix-based path matches, incorrect validation of origin headers against localhost (especially for IPv6 loopback addresses like [::1]), and redirection handling instead of explicit rejection allowed unauthenticated API interactions.
Stored XSS: The custom SVG sanitization helper (SanitizeSVG) was bypassed multiple times via namespace-prefixed elements (e.g., svg:script), white-space manipulation inside attributes, and dangerous MIME types in data URIs. This allowed attackers to execute arbitrary JavaScript within the web or Electron context when rendering SVG icons and assets.