Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spryker/kernel

              master @ e8b15db
            

Fixes

CVEs

MEDIUM

Peak severity

14.3%

Coverage

Highlights

Open Redirect: 9 prior fixes. Scrutinize any change in this area.

src/Spryker/Yves/Kernel/Controller/AbstractController.php: most-fixed (3 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Open Redirect: Misconfigurations and logical errors in the default configuration fallback logic of STRICT_DOMAIN_REDIRECT allowed attackers to bypass domain validation when the whitelist was empty. Developers must ensure default fallback states fail closed and strictly enforce domain redirection parameters.

Open Redirect: Flaws in application container flags, such as SECURED_REDIRECT_IS_HANDLED, and incorrect assumptions regarding PHP's parse_url output enabled bypasses of the domain whitelist validation. Ensuring strict boolean checks and validating external redirect URLs regardless of parse_url outcomes is essential.