Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
yiisoft/yii2-bootstrap
master @ c104a79
30
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
CSRF: 8 prior fixes. Scrutinize any change in this area.
framework/yii/web/Request.php: most-fixed (4 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A historically critical risk existed in the AccessControl filter where failing to invoke default deny callbacks could permit unauthorized access. The filter was subsequently hardened from a default-allow model to a default-deny model to mitigate bypasses.
CSRF: CSRF protections have historically been bypassed due to predictable token generation (using uniqid and mt_rand) and failure to assert validation outcomes properly, necessitating migration to cryptographically secure random token generation and XOR-masking to prevent extraction.
Insecure Deserialization: The use of PHP's native unserialize function on internal configurations or sticky runtime data posed a severe risk of arbitrary object injection and remote code execution, forcing a migration to JSON-based configurations.