Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

theonedev/onedev

              main @ 332d9b3
            

111

Fixes

CVEs

CRITICAL

Peak severity

36.8%

Coverage

Highlights

Auth Bypass: 42 prior fixes. Scrutinize any change in this area.

pom.xml: most-fixed (3 issues). Treat as high-risk during review.

95 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Most frequent class with 42 fixes; many stem from missing or insufficient permission checks on sensitive operations (issue comments, build access, job secrets, git operations).

Path Traversal: 8+ fixes for path traversal across file-serving and build/executor paths; often due to insufficient validation of user-controlled path components.

Insecure Deserialization: Multiple critical fixes involving deserialization of untrusted data; mitigated via dependency upgrades and allowlist restrictions.