Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

symfony/html-sanitizer

              8.2 @ 09e1f2f
            

Fixes

CVEs

HIGH

Peak severity

46.2%

Coverage

Highlights

Cross-Site Scripting (XSS): 4 prior fixes. Scrutinize any change in this area.

TextSanitizer/UrlSanitizer.php: most-fixed (4 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Inconsistent rendering of self-closing elements can cause parser differentials between the sanitizer and modern browsers, allowing nested markup to execute arbitrary scripts. Developers must strictly enforce the void elements allowlist.

Auth Bypass: Bypasses in URL host parsing using raw percent-encoding, bidirectional text markers, or Unicode spaces allow attackers to forge links, bypass host-matching policies, or conduct phishing spoofing.

Cross-Site Scripting: Missing target attributes in the global allowlist (such as 'srcdoc', 'action', or 'formaction') permit bypasses where users inject executable code or hijack form destinations.