Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

schmittjoh/jmsserializerbundle

              master @ 6c92613
            

Fixes

CVEs

HIGH

Peak severity

Highlights

XML External Entity (XXE): 2 prior fixes. Scrutinize any change in this area.

Serializer/XmlDeserializationVisitor.php: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): XML deserialization is highly vulnerable to XXE attacks when external entities are enabled by default or when document type definitions (DTDs) are not strictly blocked or validated. Multiple patches were required to safely configure the underlying parser and reject doctype declarations.

XML External Entity: Doctype whitelist validation was bypassed on Windows platforms because validation checks relied on the platform-specific PHP_EOL constant rather than normalizing both CR and LF line endings before loading the XML structure.

Auth Bypass: A logical flaw allowed clients to bypass read-only property constraints. Custom deserialization handlers could modify read-only fields because the GraphNavigator failed to enforce the read-only property check prior to invoking custom handler logic.