Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/zeppelin

              master @ 419d702
            

Fixes

CVEs

CRITICAL

Peak severity

42.1%

Coverage

Highlights

Auth Bypass: 34 prior fixes. Scrutinize any change in this area.

zeppelin-server/src/main/java/org/apache/zeppelin/rest/NotebookRestApi.java: most-fixed (8 issues). Treat as high-risk during review.

63 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring missing permission checks on note operations (run, write, permissions, revisions) and WebSocket message handling allow unauthorized access and modification.

Cross-Site WebSocket Hijacking: Multiple WebSocket entry points lacked Origin validation, allowing cross-site hijacking; fixes added Origin checks but coverage is fragmented.

LDAP Injection: LDAP search filters and DNs built via string concatenation with user input, fixed by RFC 4515/4514 escaping across multiple code paths.