Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozmeao/springfield

              main @ 0f8274c
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

springfield/cms/fields.py: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The application processes user-controlled SVG uploads that can contain executable scripts or highly-expanded payloads. Ineffective literal checks allowed attackers to bypass sanitization, requiring a transition to robust parsing, defusedxml validation, and rewriting raw uploads with sanitized outputs.

Cross-Site Scripting (XSS): Custom localization template tags that generate raw HTML markup using deprecated sanitizers or weak tag stripping are susceptible to XSS. Migrating to strict tools like justhtml is necessary to enforce proper scheme validation and drop dangerous script contents completely.

Denial of Service: Uploaded SVG files containing heavily nested structures can cause a denial of service due to rapid resource consumption. Safely writing these assets requires strict post-expansion size checks before saving the final payload to disk.