Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
yangzongzhuan/ruoyi-cloud
master @ b532093
22
Fixes
1
CVEs
CRITICAL
Peak severity
30.0%
Coverage
Highlights
Auth Bypass: 11 prior fixes. Scrutinize any change in this area.
ruoyi-common-core: most-fixed (3 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flawed logic in PreAuthorizeAspect and substring matching on privileged roles allowed arbitrary users to bypass security checkpoints. Exact string equivalence and strict validation are necessary.
Deserialization: The application exposed remote code execution vectors via insecure deserialization mechanisms in fastjson, redis serialization components, and transitive dependencies like velocity's commons-collections.
Reflected XSS: Unbalanced double-quote escaping in the HTMLFilter parameter serialization allowed attackers to bypass XSS filters and inject arbitrary payloads, tracked historically under CVE-2022-4348.