Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
diffplug/spotless
main @ 4ea1c6c
3
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
lib/src/main/java/com/diffplug/spotless/generic/LicenseHeaderStep.java: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: File paths are concatenated into shell command strings executed via ProcessBuilder with bash -c or cmd /c, allowing malicious file names to inject arbitrary commands. This is the most direct code-level vulnerability in the project.
Path Traversal: A vulnerable transitive dependency (plexus-utils 4.0.2) enables path traversal, likely during archive extraction or file operations. The fix was a version bump, indicating the project relies on dependency updates for security.
Insecure Transport: Formatter jars were downloaded over HTTP, exposing the build to MITM attacks. The fix updated lockfiles to HTTPS, but any new or updated dependency must be verified to use secure transport.