Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

swagger-api/swagger-ui

              master @ 0b24f42
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Reflected XSS: 12 prior fixes. Scrutinize any change in this area.

src/core/components/providers/markdown.jsx: most-fixed (5 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Unsanitized markdown input and improper HTML sanitization pipelines allow attackers to inject malicious scripts into API descriptions, leading to execution in the user's browser session.

DOM-Based XSS: Failure to validate URL schemes inside critical window-opening routines permits execution of arbitrary script payloads using `javascript:` URIs during OAuth2 authorization flows.

Reflected XSS: Custom regex sanitizers and improper escaping of variables within Handlebars templates allow dynamic parameters to bypass output filters when wrapping raw values in Handlebars.SafeString.