Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lutece-platform/lutece-core

              develop @ a707735
            

154

Fixes

CVEs

CRITICAL

Peak severity

28.9%

Coverage

Highlights

CSRF: 101 prior fixes. Scrutinize any change in this area.

AdminUserJspBean.java: most-fixed (19 issues). Treat as high-risk during review.

117 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: 19 fixes in this component alone, covering user creation, removal, role/right/workgroup changes, and security parameter modifications, indicating a persistent gap in token validation across many admin user operations.

CSRF: 7 fixes on RBAC role operations (create, modify, delete, assign users, select permissions, remove control) show systematic missing token validation across the role management surface.

Reflected XSS: Multiple fixes to the sanitizer itself (backtick escaping, fallback sanitizer, OWASP integration) indicate the sanitization logic was repeatedly found incomplete, risking bypasses across all request parameters.