Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

web-infra-dev/rsbuild

              main @ 034241f
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

CORS Misconfiguration: 2 prior fixes. Scrutinize any change in this area.

packages/core/src/config.ts: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CORS Misconfiguration: Unconditionally setting wildcard CORS headers ('Access-Control-Allow-Origin', '*') on dev server middleware exposes local development resources to arbitrary origins. The fix guarantees that the user-defined `server.cors` configuration option is respected.

Cross-Site Scripting (XSS): Failure to consistently inject CSP nonces into generated HTML tags (specifically style and inline script elements) allows attackers to bypass Content Security Policies, leading to potential XSS execution.

CORS Misconfiguration: Having CORS enabled by default in development and preview environments expanded the attack surface unnecessarily. Security was improved by turning off CORS by default out of the box.