Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

snowflakedb/gosnowflake

              master @ 136b057
            

Fixes

CVEs

HIGH

Peak severity

20.0%

Coverage

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

crl.go: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Insecure handling of SSO browser URLs allowed malicious authentication endpoints to achieve remote command injection on user machines. Developers must rigorously validate external URLs against strict schemas before execution.

Auth Bypass: A copy-paste logic error in `isPrefixEqual` skipped port comparison checks on matching hosts during SAML prefix validation, permitting unauthorized port authentication bypasses.

Denial of Service: Unbounded resource allocation during Certificate Revocation List (CRL) retrieval and unhandled system environment variations (such as a missing HOME directory) caused application panics and resource depletion.