Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

springdoc/springdoc-openapi

              main @ 209d7b5
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Cross-Site Request Forgery: 2 prior fixes. Scrutinize any change in this area.

springdoc-openapi-common: most-fixed (4 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Open Redirect: Allowing Swagger UI configuration via URL parameters can lead to open redirects and potential DOM-based cross-site scripting when processing untrusted query inputs.

Cross-Site Request Forgery: Swagger UI request interceptors originally failed to validate destination origins, leaking sensitive CSRF tokens to external, cross-origin hosts.

Information Disclosure: Generated OpenAPI specifications can expose sensitive Spring Security parameter structures unless they are explicitly filtered and ignored during schema generation.