Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getsentry/sentry-php

              master @ a403c11
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Information Disclosure: 8 prior fixes. Scrutinize any change in this area.

lib/Raven/Client.php: most-fixed (4 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: A critical failure mode exists where sanitized data structures (such as breadcrumbs or general serialized fields) are either not properly assigned back to their reference variables, or the default sanitization processor is not enabled. This completely bypasses the data-masking pipeline, causing raw, sensitive variables and objects to be transmitted in plain text.

Information Disclosure: Incomplete coverage of sensitive fields (such as authorization headers and session cookies) in the sanitization lists leads to credential leakage within HTTP payloads transmitted to Sentry. Expanding the default sanitization regexes and target blocks is essential to protect user session state and bearer tokens.

Man-in-the-Middle: Prior to bundling and configuring a default local CA certificate bundle (`cacert.pem`), TLS/SSL peer verification could fail or be bypassed entirely during event transmission via cURL, exposing client-server communication to eavesdropping and manipulation.