Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

darylldoyle/svg-sanitizer

              master @ c1ad90f
            

Fixes

CVEs

HIGH

Peak severity

72.7%

Coverage

Highlights

Cross-Site Scripting (XSS): 12 prior fixes. Scrutinize any change in this area.

src/Sanitizer.php: most-fixed (21 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Attackers frequently bypass schema and protocol validation inside links by using mixed-case attribute names, hidden namespaces, or leading whitespace in attributes like href and xlink:href. Strict canonicalization and exhaustive whitelist-based validation are required.

XML External Entity (XXE): XML parser configurations that resolve external entities or allow DOCTYPE declarations expose the application to local file disclosure and server-side request forgery. Postponing DOCTYPE checks or failing to disable the entity loader during parsing triggers this risk.

Remote Code Execution: Allowing PHP processing instructions to persist in sanitized SVGs can lead to RCE if the output SVG is subsequently interpreted or evaluated as PHP code. Recursive and complete stripping of PHP tags is necessary to prevent bypasses.