Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

blockscout/frontend

              main @ 1089d07
            

Fixes

CVEs

HIGH

Peak severity

70.6%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

lib/api/useApiFetch.tsx: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple high-severity fixes show that authentication checks were missing or stubbed across different API consumers and UI actions, indicating a systemic risk of unauthenticated access to privileged operations.

CSRF: CSRF protections were added piecemeal to specific API calls (contractInfo, admin) and then strengthened by moving the token to a header, but the CORS config had to be adjusted to prevent token leakage, showing ongoing fragility in CSRF defense.

SSRF: Two separate SSRF vulnerabilities were found in server-side fetch endpoints: one in the proxy and one in a media-type checker. The proxy now has an origin allow-list, but the media-type endpoint was removed entirely, indicating a history of unvalidated URL fetching.