Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

stashapp/stash

              develop @ 405c67d
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Denial of Service: 17 prior fixes. Scrutinize any change in this area.

internal/api: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: A SQL Injection vulnerability (CVE-2024-32231) existed in the database layer where untrusted sort parameters were directly interpolated into SQL queries. Attackers could exploit this to execute arbitrary commands. Future sorting routes must enforce strict allowlists.

Authentication Bypass: Logic inversions in the authenticateHandler (incorrectly handling ErrUnauthorized) and unvetted proxy headers allowed remote attackers to bypass session controls. Session validation logic must be foolproof and treat failures as terminal.

Path Traversal: The plugin assets routing and background file-cleaning task (task_clean.go) were vulnerable to directory traversal by failing to check path prefixes, potentially exposing internal files or letting tasks scan unauthorized directories.