Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yiisoft/yii2-bootstrap4

              master @ 70897f3
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

CSRF: 8 prior fixes. Scrutinize any change in this area.

framework/yii/web/Request.php: most-fixed (4 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: A critical failure in the request validation pipeline returned boolean validation status checks but did not abort execution, allowing requests to continue processing even when CSRF checks failed. Developers must ensure that all controller routing mechanisms strictly validate and halt execution on failure.

Auth Bypass: The AccessControl component historically relied on an insecure default-allow architecture when no validation rules matched or when handling default-deny decisions, which failed to trigger proper denyCallback actions. Proper authentication filters must use a default-deny paradigm.

Insecure Deserialization: The use of native PHP unserialize on persistent runtime data or configuration files presented remote code execution vectors, necessitating a migration to JSON serialization formats.