Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/Entrust/HasRole.php: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Weak parameter normalization and loose type coercion during validation checks allow invalid or manipulated inputs to bypass role and permission checks in the EntrustAbility middleware.

Auth Bypass: Unauthenticated guest requests to endpoints protected by Entrust middlewares could lead to null-pointer dereferences or authorization bypasses because the middleware lacked explicit pre-checks for guest users.

Auth Bypass: Deleting user models without automatically detaching their roles in the database can cause stale database relations, leading to potential privilege inheritance or bypasses for future users with recycled identifiers.