Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

andrewsville/php-token-reflection

              develop @ 1c5ff91
            

Fixes

CVEs

HIGH

Peak severity

75.0%

Coverage

Highlights

Code Injection: 2 prior fixes. Scrutinize any change in this area.

TokenReflection/Broker.php: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: eval was used to parse constant values, enabling arbitrary code execution; replaced with Resolver::getValueDefinition, but any residual eval path remains critical.

Code Injection: eval for default values was moved to runtime but remains enabled by default, so the injection sink is still reachable unless explicitly disabled.

Access Control: File filtering lacked proper whitelist/blacklist semantics, allowing unintended files to be processed; fix added '!' prefix distinction but only for one path.