Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sobolevn/git-secret

              master @ e9b840b
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Command Injection: 5 prior fixes. Scrutinize any change in this area.

src/_utils/_git_secret_tools.sh: most-fixed (6 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Unquoted arguments and string-concatenated commands passed to bash -c, gawk, and gpg allow arbitrary shell execution, especially when processing filenames with spaces or special characters. Refactoring to safe bash arrays is crucial.

Command Injection: Key variables passed into internal gawk functions without appropriate shell single-quoting allow user-controlled data to hijack the awk processor execution context during encryption.

Insecure Temporary File: Failure to immediately clean up GPG public key rings or temporary keyfiles generated during imports can lead to persistent sensitive artifacts remaining on disk.