Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
filp/whoops
master @ cdef16d
3
Fixes
1
CVEs
MEDIUM
Peak severity
Highlights
Reflected XSS: 2 prior fixes. Scrutinize any change in this area.
Whoops/Util/TemplateHelper.php: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Reflected XSS: Insecure dumping of template values using print_r without output encoding allows attackers controlling the template variables to execute arbitrary script in the victim's browser, leading to Reflected XSS. This vulnerability was published as CVE-2017-16880.
Reflected XSS: Plain-text exception prefaces embedded directly inside HTML comments can be broken out of if not properly escaped, enabling cross-site scripting attacks directly inside the error-reporting views.
Information Disclosure: Verbose exception stack traces and variable states dumped directly into HTML output by the template helper can leak sensitive internal environment information if not strictly filtered.