Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
AikidoSec/firewall-php
main @ c8c3feb
9
Fixes
0
CVEs
HIGH
Peak severity
42.9%
Coverage
Highlights
SSRF: 4 prior fixes. Scrutinize any change in this area.
lib/php-extension/Cache.cpp: most-fixed (1 issue). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SSRF: Attackers can bypass initial checks using DNS rebinding or TOCTOU exploits. The firewall mitigates this by validating the final resolved IP address via post-request curl metadata checks. Developers must ensure all outgoing request hooks use the same post-execution resolution validation.
Path Traversal: Bypasses occur when URI wrappers such as 'file://' or 'php://' bypass detection rules because of case-sensitive prefix checks. Sanitization and detection routines must consistently enforce case-insensitive matching across both the PHP extension hooks and Go processing components.
SSRF: When HTTP redirects occur, the request context can lose its tracking state, allowing subsequent requests to bypass SSRF validations. State must be preserved across the entire redirect lifecycle.