Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
zenc-lang/zenc
main @ c5da595
4
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Command Injection: 2 prior fixes. Scrutinize any change in this area.
src/analysis/typecheck.c: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Insecure process spawning using the system() shell-wrapper allowed arbitrary code execution during compiler driver invocations. Developers must use array-based argument vectors directly for external processes instead of constructing raw shell strings.
Command Injection: Compilation directives like 'shell:' and 'get:' allowed arbitrary code execution when processing untrusted source inputs. These behaviors must remain disabled by default with strict validation controls.
Stack-based Buffer Overflow: Unbounded string formatting (sprintf) with fixed-size buffers during identifier mangling poses a risk of memory corruption. Dynamics-based memory allocation (strlen) paired with snprintf must be consistently applied.