Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/linkis

              master @ bad400a
            

Fixes

CVEs

CRITICAL

Peak severity

45.9%

Coverage

Highlights

Auth Bypass: 16 prior fixes. Scrutinize any change in this area.

linkis-commons/linkis-common/src/main/java/org/apache/linkis/common/utils/SecurityUtils.java: most-fixed (3 issues). Treat as high-risk during review.

40 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple distinct bypasses in the gateway authentication flow: ignore-timeout cookie/header fallback without source-IP gating, missing server-side session check, empty pass-auth URI matching, proxy-user assignment, and IP spoofing via proxy headers. These are systemic issues in the authentication core.

JDBC URL/Parameter Injection & SSRF: A series of fixes address JDBC connection string injection (DB2 denylist, MySQL URL regex, dangerous params like autoDeserialize), but the pattern of encoded-parameter bypass and security checks being moved or skipped indicates the validation logic is fragile and must be centralized and enforced on every connection path.

Insecure Deserialization: Deserialization vulnerabilities found in CryptoUtils (no class whitelist) and JDBC connections (autoDeserialize param) allow RCE. These are separate sinks but share the root cause of trusting untrusted serialized data or connection parameters.