Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

648540858/wvp-GB28181-pro

              master @ fafb69d
            

Fixes

CVEs

CRITICAL

Peak severity

51.4%

Coverage

Highlights

Auth Bypass: 20 prior fixes. Scrutinize any change in this area.

src/main/java/com/genersoft/iot/vmp/conf/security/JwtUtils.java: most-fixed (4 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Logical flaws in JWT handling, missing WebSocket token extraction, and improper mapping of security context identifiers repeatedly permitted unauthorized operations. Ensuring consistent validation across alternate protocols like WebSockets is critical.

SQL Injection: Repeated use of raw string concatenation placeholders ($) instead of parameterized precompiled queries (#) in dynamic SQL providers and MyBatis XML mappers allowed arbitrary SQL execution.

Auth Bypass: Bypasses in ZLM media hook listener logic occurred when unverified or missing stream authority records incorrectly resolved to authorized sessions, skipping verification.