Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

osm-search/Nominatim

              master @ 2182dd9
            

Fixes

CVEs

HIGH

Peak severity

20.0%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

src/nominatim_api/search/icu_tokenizer.py: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Multiple fixes in this component address resource exhaustion from overly long queries, oversized terms, and invalid category tokens, indicating a high-risk surface for DoS via crafted search inputs.

SQL Injection: Dynamic SQL in a database trigger used unvalidated table names, leading to a high-severity injection. The fix added a regex check, but similar patterns may exist in other trigger functions.

SQL Injection: Unsafe string concatenation in TRUNCATE statements was fixed with psycopg2.sql.Identifier, but other database import operations may still use raw string formatting.