Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tchapgouv/tchap-web-v4

              develop_tchap @ 6ed197e
            

Fixes

CVEs

HIGH

Peak severity

39.5%

Coverage

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

src/HtmlUtils.js: most-fixed (5 issues). Treat as high-risk during review.

59 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes enforce post-login verification, session ownership, and guest checks, indicating a persistent risk of bypassing authentication/verification flows, especially around OIDC and device verification.

Authorization Bypass: Permission checks are added piecemeal to UI actions (invites, file uploads, poll creation, community settings), showing a systemic gap where client-side actions are not consistently gated by power levels.

Stored XSS: XSS persists in HTML rendering paths—message highlighting, topic rendering, linkification, and HTML export—indicating sanitization is often bypassed or applied inconsistently.