Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cdapio/cdap

              develop @ 01959c8
            

149

Fixes

CVEs

CRITICAL

Peak severity

18.2%

Coverage

Highlights

Auth Bypass: 87 prior fixes. Scrutinize any change in this area.

cdap-app-fabric/src/main/java/co/cask/cdap/gateway/handlers/AuthorizationHandler.java: most-fixed (4 issues). Treat as high-risk during review.

126 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes show lifecycle endpoints (start/stop, schedule, runtime args, list) were missing authorization or had checks bypassed by internal call paths.

Auth Bypass: Artifact operations (deploy, localize, delete) lacked authorization, and internal localization requests did not carry end-user credentials.

Auth Bypass: Dataset REST APIs and runtime method interception had gaps; unannotated dataset methods bypassed authorization entirely.