Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

elharo/xom

              master @ 025787e
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Security Bypass: 1 prior fix. Scrutinize any change in this area.

src/nu/xom/Builder.java: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML Injection: Direct injection of malicious markup into internal DTD subset via insufficient validation of XML names and markup characters.

Security Bypass: Known insecure parsers (Saxon, GNU JAXP) could bypass XML validation unless forced to use verifying factory.

XML External Entity (XXE): XInclude processing allowed non-fallback children from XInclude namespace, enabling XXE or resource manipulation.