Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Atlanhq/application-sdk

              main @ 1bac756
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Path Traversal: 5 prior fixes. Scrutinize any change in this area.

application_sdk/handler/service.py: most-fixed (3 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The application retrieves workflow configuration files and processes object store paths dynamically. Path traversal sequences in configuration identifiers can allow unauthorized reading of local/remote storage paths if not validated at the route level.

Insecure Deserialization: The historical usage of the unmaintained 'sqlitedict' library exposed the application to arbitrary code execution vector CVE-2024-35515. The introduced SpillableDict utility must remain the standard to prevent insecure deserialization.

SQL Injection: User-supplied filters and regular expression fields merged directly into SQL query templates can lead to arbitrary SQL injection. Validation patterns must strictly reject quotes and SQL-meaningful sequences before string substitution.