Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wechat-group/wxjava

              develop @ 4083e35
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

XXE: 3 prior fixes. Scrutinize any change in this area.

weixin-java-common: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XXE: XML payload parsing is widely used across WeChat API operations (e.g., XmlUtils, message decryption, and payment results), which has historically led to multiple critical XXE vulnerabilities due to insufficient restriction of DOCTYPE declarations and external DTDs.

Signature Validation Bypass: Payment and score notification callback entry points could be spoofed if signature verification checks are omitted, allowing unauthorized modification of payment statuses.

Auth Bypass: An inverted comparison operator in the certificate update scheduling check can cause certificate updates to fail, potentially breaking trust validation or causing a fallback to weaker security states.