Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yiisoft/yii2-composer

              master @ 495ec64
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

CSRF: 8 prior fixes. Scrutinize any change in this area.

framework/yii/web/Request.php: most-fixed (4 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: CSRF protection has suffered from systemic issues, including weak token generation using predictable sources like uniqid, tokens exposed via compression side-channels (BREACH), and failures to abort request execution even when validation failed. Developers must ensure masked CSRF tokens and secure random generators are strictly utilized.

Auth Bypass: Access control structures historically suffered from a dangerous default-allow architecture and failures to trigger deny-access callbacks during a default-deny decision, leading to unauthorized state transitions.

Insecure Deserialization: The use of PHP's native unserialize function on internal runtime files and configuration data allowed attackers to perform arbitrary object injection, which can lead to remote code execution.