Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
AikidoSec/firewall-node
main @ 25ad493
34
Fixes
0
CVEs
HIGH
Peak severity
34.5%
Coverage
Highlights
SSRF: 10 prior fixes. Scrutinize any change in this area.
library/vulnerabilities/path-traversal/detectPathTraversal.ts: most-fixed (4 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SSRF: Bypasses in redirect tracking allowed attackers to route requests to internal or private IP destinations because the HTTP client's redirect chain context was lost across asynchronous callbacks.
Path Traversal: Differences in how path casing and control characters were processed relative to underlying filesystems led to recurrent path traversal bypasses. Normalization to lowercase and early control character stripping were required to secure path evaluation.
Auth Bypass: The IDOR checker could be bypassed when queries contained unresolvable tenant placeholders or when SQL dialect differences were cached incorrectly, leading to incorrect validation reuse.