Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yiisoft/yii2-swiftmailer

              master @ eb11929
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

CSRF: 8 prior fixes. Scrutinize any change in this area.

framework/yii/web/Request.php: most-fixed (4 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: CSRF protection mechanisms were historically disabled by default, failed to halt request execution on validation failure, and used weak random number generation or unmasked tokens vulnerable to BREACH side-channel attacks.

Auth Bypass: The access control filter historically failed to default-deny unmatched rules and failed to correctly invoke the deny callback/handler upon default-deny decisions, allowing unauthorized operations.

Insecure Deserialization: Using PHP's native unserialize function on internal configurations or runtime key storage files introduced Remote Code Execution risks, which required migration to JSON decoding or secure serialize alternatives.