Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/skywalking-java

              main @ 25e27a8
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

H2AlarmQueryDAO: most-fixed (1 issue). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: String concatenation into LIKE clauses allowed injection; fixed via parameterized queries. Similar patterns may exist in other DAO query builders.

SQL Injection: String concatenation in IN clause executed via executeQuery; fixed with PreparedStatement. Other metrics queries may still use concatenation.

Sandbox Escape: GroovyShell allowed arbitrary code; fixed by SecureASTCustomizer restricting statements and receivers. Other DSL evaluation paths may lack similar restrictions.