Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
root-gg/plik
master @ 8dd88a8
38
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 17 prior fixes. Scrutinize any change in this area.
client/config.go: most-fixed (4 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: OAuth2 login flows failed to validate domains on every login and did not properly handle callback errors, potentially allowing invalid or external accounts to successfully authenticate. This was hardened by validating user identity claims and enforcing strict return-on-error behavior.
Auth Bypass: Use of a deprecated and vulnerable JWT library (dgrijalva/jwt-go) combined with a lack of embedded session expiration deadlines allowed persistent session validity and potential signature bypasses. Hardening required migrating to jwt/v5 and adding creation-timestamp validation inside session cookies.
Stored XSS: SVG, XML, and other rich text types uploaded by users were served to browsers without sufficient neutralization, enabling stored cross-site scripting. Resolving this required forcing dangerous mime-types to application/octet-stream and sanitizing markdown views using DOMPurify.