Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla/pontoon

              main @ f2d1b55
            

Fixes

CVEs

HIGH

Peak severity

55.6%

Coverage

Highlights

Reflected XSS: 3 prior fixes. Scrutinize any change in this area.

pontoon/settings/base.py: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: GraphQL endpoint was exempted from CSRF and CSP, allowing cross-site requests to mutate data; removal of exemptions restores framework defenses.

Auth Bypass: Overly broad Mozillians group allowlist granted localization rights to unintended members; narrowing to 'localization' enforces least privilege.

Path Traversal: Using untrusted project.name in filesystem paths allowed traversal; switching to slug removes path separators and dot-dot sequences.