Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

symfony/browser-kit

              8.2 @ f2ac860
            

Fixes

CVEs

MEDIUM

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

CookieJar.php: most-fixed (5 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inadequate prefix validation and null-domain handling in CookieJar.php repeatedly allowed cookies to be retrieved across unauthorized paths and subdomains, violating expected isolation boundaries.

Cookie Leakage: Insufficient domain suffix validation (e.g., missing dot enforcement) allowed cookies scoped for a specific domain to be leaked to unauthorized sibling domains sharing a common string suffix.

Auth Bypass: Accepting the secure flag over plaintext transport or undefined context allows session cookies to be processed insecurely, violating Transport Layer Security boundaries.