Security context

Highlights

CSRF: 1 prior fix. Scrutinize any change in this area.

src/Forms/Form.php: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Path Traversal: Validators previously inspected pre-sanitized filenames instead of raw, untrusted input. This allowed attackers to craft payloads that bypassed file upload safety restrictions by exploiting differences between the sanitized name and the actual file handled.

CSRF: Forms historically relied on less reliable SameSite cookie detection for cross-site request verification. Attackers could potentially forge state-changing form submissions if browsers did not strictly enforce SameSite attributes, which was mitigated by introducing explicit Sec-Fetch-Site header checks.