Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla/bugzilla

              master @ fa24c29
            

252

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Auth Bypass: 67 prior fixes. Scrutinize any change in this area.

Bugzilla/Bug.pm: most-fixed (18 issues). Treat as high-risk during review.

182 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address bypasses in bug visibility and modification checks, often via inconsistent group checks or missing authorization in specific code paths (e.g., product moves, clones, dependency edits).

CSRF: Numerous state-changing endpoints lacked CSRF token validation, allowing cross-site request forgery. Fixes add check_hash_token or similar across many actions, indicating a systemic gap.

Information Disclosure: Multiple fixes prevent leakage of bug summaries, group names, product names, and SQL debug details to unauthorized users, often by adding visibility checks or gating debug output behind groups.