Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yiisoft/yii2-debug

              master @ 0811888
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

CSRF: 9 prior fixes. Scrutinize any change in this area.

framework/yii/web/Request.php: most-fixed (4 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Direct construction of conditions within SQL queries allowed potential SQL injection. Mitigation required refactoring the query builder to enforce parameter binding instead of embedding literal values.

Auth Bypass: Yii's AccessControl filter historically defaulted to an insecure 'default-allow' model or failed to trigger the proper access denial callbacks, leading to authorization bypasses when rules did not match explicitly.

Insecure Deserialization: Using PHP's native unserialize() function on configuration or runtime files allowed arbitrary object injection and potential Remote Code Execution, requiring migration to secure JSON formats.