Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

thephpleague/commonmark

              2.8 @ de5a7e7
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

src/Extension/Attributes/Util/AttributesHelper.php: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The AttributesExtension allowed arbitrary attribute injections, including 'on' event handlers and javascript: URIs, unless strict prefix stripping and the 'allow_unsafe_links' policy were enforced. Failure to filter these attributes leads directly to stored or reflected XSS within rendered markdown.

Cross-Site Scripting (XSS): Insufficiencies in regular expression matching allowed attackers to bypass HTML tag sanitization by inserting non-standard whitespace characters like newlines and tabs immediately following disallowed tag names. This bypass let raw, executable HTML render directly into output.

Server-Side Request Forgery: Weak hostname matching in the Embed domain filter failed to enforce strict boundaries, allowing domains like 'example.com.evil.com' to pass validation intended exclusively for 'example.com'. This can result in unauthorized SSRF-like behavior or data leakage via malicious embed domains.