Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Stirling-Tools/Stirling-PDF

              main @ c22d9ec
            

101

Fixes

CVEs

HIGH

Peak severity

22.6%

Coverage

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

SecurityConfiguration.java: most-fixed (5 issues). Treat as high-risk during review.

72 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Recurring SSRF fixes across diverse URL-fetching paths indicate a systemic lack of a single, centralized egress guard. Each fix adds a different check (private IP ranges, protocol allowlist, URL allowlist, host allowlist) that may not be enforced on all sibling paths.

Auth Bypass: Dominant vulnerability class with 25+ fixes. Recurring issues include SSO/OAuth2 registration bypass, disabled-feature access, session handling, and role/team assignment errors. The breadth suggests fundamental flaws in the authentication/authorization model that are patched reactively.

Path Traversal: Path traversal fixes are scattered across many file-handling endpoints with varying validation approaches (rejecting '..', using File.getName(), canonicalization). This inconsistency creates high risk of a missed endpoint or a bypass via alternate encoding.