Security context

Highlights

Authentication Bypass: 2 prior fixes. Scrutinize any change in this area.

src/auth.c: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Authentication Bypass: Fragile control flow in TLS client certificate validation can lead to complete authentication bypass if case-handling statements lack explicit fall-through prevention (like missing break statements).

Authentication Bypass: Incorrect verification step ordering and unsafe route dispatching can allow digest authentication paths to bypass password verification mechanisms entirely.

Buffer Overflow: The use of unsafe string formatting functions like sprintf during URL character validation and file upload handling risks memory corruption via buffer overflows.