Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mozilla/bedrock
main @ eaa42c1
31
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 6 prior fixes. Scrutinize any change in this area.
requirements/prod.txt: most-fixed (3 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Stored XSS: The application permits SVG uploads, which are inherently high-risk vectors for Stored XSS. Initial validation filters were bypassed or insufficient, requiring a multi-layered validation architecture (including py-svg-hush, defusedxml, and regex verification) to ensure file content is completely sanitized prior to being stored or rendered.
Cross-Site Scripting (XSS): Localisation translations (Fluent) were previously trusted blindly and marked safe for Django template rendering. If translation strings are manipulated or contain unsafe characters, this introduces an direct path to XSS, requiring mandatory Bleach sanitization before marking strings as safe.
Denial of Service: Unchecked Unicode data inside redirect configurations routinely caused uncaught exceptions (e.g., UnicodeEncodeError and UnicodeDecodeError) when processing non-ASCII characters, crashing specific endpoints. Sanitization using force_text and restricting capture groups to safe ASCII characters were required to stabilize the redirection router.