Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
unicomai/wanwu
main @ 9ee6231
39
Fixes
0
CVEs
HIGH
Peak severity
44.4%
Coverage
Highlights
Auth Bypass: 20 prior fixes. Scrutinize any change in this area.
internal/bff-service/service/oauth.go: most-fixed (3 issues). Treat as high-risk during review.
28 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The project has suffered numerous authorization bypasses due to inconsistent credential verification, such as missing database checks for OpenAPI keys, flawed organization-membership status validation during login, and incorrect identifier schema differentiation in model checks.
Path Traversal: Unsafe handling of extracted zip archives (Zip Slip) and file canonicalization failures allowed attackers to write or access files outside the intended destination directory.
Open Redirect: The OAuth flow was vulnerable to Open Redirect and potential token leakage due to reliance on user-provided redirection parameters without strict validation against pre-registered, parsed, and restricted URI schemes.