Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vmg/redcarpet

              master @ 34c138e
            

Fixes

CVEs

HIGH

Peak severity

75.0%

Coverage

Highlights

Cross-Site Scripting (XSS): 4 prior fixes. Scrutinize any change in this area.

ext/redcarpet/html.c: most-fixed (5 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Incomplete handling of HTML rendering options like `:escape_html` alongside specific Markdown extensions (such as `:quote`) allowed bypasses that let attackers inject malicious scripts, leading to CVE-2020-26298. Developers must ensure that all combinations of parser options consistently invoke the HTML escaping pipeline.

Memory Safety: Unsafe stack-allocated buffers and standard library functions (`strcpy`/`strcat`) used during header anchor generation resulted in a stack-based buffer overflow (CVE-2015-5147). Native memory operations should write directly to bounded dynamic buffers (`bufput`) with strict size guarantees.

Cross-Site Scripting (XSS): Sanitization bypasses occur when nested or block elements are parsed without verifying constraints such as `:no_styles` or `:safe_links_only` across all HTML output streams, leading to unfiltered `<style>` blocks and malicious `javascript:` URIs.