Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
thingsboard/tbel
master @ 0aac067
12
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Sandbox Escape: 12 prior fixes. Scrutinize any change in this area.
SandboxedClassLoader.java: most-fixed (5 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: The class loader is the primary boundary for the sandbox, and it has been patched five times for various bypasses, including dangerous packages, module access, and MVEL internals. Each fix adds a new blocklist entry, indicating that the loader's denylist is incomplete and can be bypassed by other untracked packages or methods.
Sandbox Escape: Import handling is a critical escape vector. Two separate fixes were needed to block imports in sandboxed mode (one in the generic ParserContext, one in the sandboxed subclass), showing that the import path was initially unguarded and required both a base-class and a subclass-level fix.
Sandbox Escape: The method allowlist (isMethodAllowed) was bypassed via method name spoofing. The fix had to add a declaring-class-name check, indicating that the allowlist originally matched only method names and could be fooled by a method with a permitted name but a forbidden declaring class.