Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

fruitcake/php-cors

              master @ 5c0458a
            

Fixes

CVEs

HIGH

Peak severity

Highlights

CORS Misconfiguration: 4 prior fixes. Scrutinize any change in this area.

src/CorsService.php: most-fixed (4 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CORS Misconfiguration: Flaws in regex validation of wildcard origins allowed unauthorized origins to bypass checks. Strict prefix and suffix pattern anchoring is necessary to prevent malicious origins from mimicking trusted patterns.

Insecure CORS Policy: An incorrect order of operations during options normalization could evaluate wildcard patterns after the allowed origins list was cast to a boolean, rendering the wildcard matching logic ineffective.

CORS Misconfiguration: Auxiliary headers like Access-Control-Allow-Credentials could be appended even if the origin validation failed or was missing, potentially leaking credentials on unvetted requests.