Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
thomiceli/opengist
master @ 5afef9a
26
Fixes
0
CVEs
HIGH
Peak severity
30.8%
Coverage
Highlights
Auth Bypass: 11 prior fixes. Scrutinize any change in this area.
internal/git/commands.go: most-fixed (8 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes address unauthorized git operations by adding token auth, permission checks against the authenticated user, and require-login enforcement. The risk is that sibling git access paths (HTTP, SSH, receive-pack) may still miss one of these checks.
Path Traversal / Symlink Attack: Fixes prevent writing/renaming outside the repo via symlinks or user-controlled paths. The risk is that other file operations (e.g., in different handlers) may not enforce the same symlink/path validation.
Denial of Service: Fixes address panics, unbounded memory, and zombie processes in git subprocess handling. The risk is that other git command paths or parsers may still lack bounds checks or resource limits.