Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tw93/mole

              main @ 650ec42
            

Fixes

CVEs

HIGH

Peak severity

56.7%

Coverage

Highlights

Path Traversal: 20 prior fixes. Scrutinize any change in this area.

lib/core/file_ops.sh: most-fixed (9 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple fixes harden deletion validation by canonicalizing paths, resolving symlinks, and rejecting bare roots; missing these checks allows deletion of critical system directories.

Path Traversal: User-data path construction and receipt-file scanning were hardened with reverse-DNS validation and boundary checks on bundle IDs/app names to prevent arbitrary file deletion.

Privilege Escalation: Privileged deletes/moves on user-controllable parent paths were hardened with ancestor ownership/mode/symlink/ACL validation and a root-owned staging directory to close TOCTOU.