Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
friendsofsymfony/fosrestbundle
3.x @ 0a0d597
4
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
View/JsonpHandler.php: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inappropriate escaping of configured validation rules using `preg_quote` rendered regex parameter validation ineffective, allowing arbitrary input to bypass security checks. This is a critical risk when developers rely on ParamFetcher constraints to sanitize inputs or enforce access controls.
Reflected XSS: Weak internal validation of query parameters specifying the JSONP callback allowed malicious actors to inject arbitrary scripts. Relying on custom regexes for callback validation is historically fragile compared to dedicated validation libraries.
Rosetta Flash CSRF Bypass: Without defensive content prefixes, JSONP responses could be interpreted as valid Flash (SWF) files, allowing cross-site requests to execute in the context of the user's session.