Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

stravu/crystal

              main @ 1e18e0b
            

Fixes

CVEs

CRITICAL

Peak severity

0.0%

Coverage

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

frontend/src/components/session/GitErrorDialog.tsx: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Git-related operations utilized unsafe string interpolation inside a shell executor (execSync). This allows local or remote-influenced inputs to run arbitrary shell commands on the host system. Future implementations must consistently use structured, non-shell command executions with safe argument escaping.

Sandbox Escape: The sandbox mode restrictions for Codex were bypassed due to passing invalid command-line configuration arguments to spawn. Developers must ensure parameters are properly encapsulated in structured configuration objects rather than appended dynamically as array flags.

Reflected XSS: Unsanitized output from Git commands was directly rendered in the UI using dangerouslySetInnerHTML, leading to cross-site scripting vulnerabilities. DOMPurify or safe templating wrappers must always sanitize terminal/system outputs before DOM injection.