Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
bazelbuild/bazel-central-registry
main @ b559e0c
11
Fixes
0
CVEs
HIGH
Peak severity
85.7%
Coverage
Highlights
Path Traversal: 4 prior fixes. Scrutinize any change in this area.
tools/bcr_validation.py: most-fixed (7 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Untrusted archive extraction and directory structures can escape planned limits. Relies on secure zip/tar extraction filters, symlink blocking, and robust prefix checks to prevent writing outside designated boundaries.
Auth Bypass: Registry metadata verification and approval workflows are susceptible to commit spoofing and account takeover when relying on mutable GitHub identifiers. It is critical to enforce ownership validation of user IDs and confirm git references originate from the original upstream repository.
Path Traversal: Local patch storage and client paths must resolve relative-to checks to prevent directory traversal outside the defined patches directory using relative path descriptors.