Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/java-storage

              main @ 679cddd
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Integrity Check Bypass: 5 prior fixes. Scrutinize any change in this area.

.github/workflows/hermetic_library_generation.yaml: most-fixed (1 issue). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Integrity Check Bypass: Four separate gRPC upload channel implementations lacked client-side validation of ack'd object size against expected size, allowing acceptance of incomplete or corrupted uploads. This is the most frequent vulnerability class and spans multiple entry points, indicating a systemic gap in enforcing upload integrity.

Auth Bypass: Resumable upload write calls did not propagate the grpcCallContext with userProject metadata, causing loss of x-goog-user-project header and potential auth/billing context bypass. This affects multiple write session configurations, risking incorrect project attribution or authorization.

Auth Bypass: Credentials provider was created without a null check, allowing authentication bypass when credentials could not be resolved. This could lead to unauthenticated access to storage operations.