Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

patrickhener/goshs

              main @ a0392bc
            

Fixes

CVEs

CRITICAL

Peak severity

35.1%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

httpserver/handler.go: most-fixed (14 issues). Treat as high-risk during review.

31 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical/high auth bypasses across different servers and handlers, often due to flawed condition logic or missing ACL checks on alternative paths. Token-based and exemption-based gates have repeatedly failed to cover all sensitive operations.

Path Traversal: Critical path traversal in file rename (SFTP) and multi-handler write/delete paths due to missing or inconsistent sanitization. Centralized sanitizePath introduced but must be enforced on every sink.

Improper Enforcement of Write Restrictions: Recurring bypass of --no-delete/--upload-only/--read-only flags across FTP, HTTP PUT, WebDAV, and SMB, often via missing pre-existing-file checks or incomplete WebDAV verb coverage.