Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jnunemaker/httparty

              main @ 8f4a09e
            

Fixes

CVEs

HIGH

Peak severity

75.0%

Coverage

Highlights

Open Redirect: 2 prior fixes. Scrutinize any change in this area.

lib/httparty/request.rb: most-fixed (3 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Absolute URLs with a host different from base_uri could be requested, allowing SSRF to internal services; fix added a host allowlist check but only for the initial request path.

Improper Certificate Validation: SSL verification was disabled by default (VERIFY_NONE), enabling MITM; fix defaults to VERIFY_PEER with system store, but custom connection adapters may still override.

Open Redirect: Redirect handling sets self.path from response['location'] without validating the target host or scheme; two fixes only changed method/cookie handling, not target validation.