Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jetbrains/kotlin

              master @ b143655
            

Fixes

CVEs

HIGH

Peak severity

35.7%

Coverage

Highlights

Path Traversal: 4 prior fixes. Scrutinize any change in this area.

libraries/stdlib/jdk7/src/kotlin/io/path/PathRecursiveFunctions.kt: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple archive extraction and path resolution functions lacked canonicalization and containment checks, allowing writes outside target directories via symlinks or '..' sequences.

Insecure Deserialization: KAPT incremental caches were deserialized with unrestricted ObjectInputStream, enabling gadget attacks. Fixes added class whitelists/allowlists but may not cover all cache loaders.

Insecure Temporary File: Legacy temp file creation (Guava createTempDir, unsafe Files APIs) led to predictable paths and symlink attacks, as reflected in CVE-2020-29582 and CVE-2020-15824.