Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bcit-ci/CodeIgniter

              develop @ 3658d73
            

203

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Cross-Site Scripting (XSS): 39 prior fixes. Scrutinize any change in this area.

system/core/Security.php: most-fixed (74 issues). Treat as high-risk during review.

86 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The custom xss_clean utility has been a persistent vector for evasion. Attackers repeatedly bypassed filters using nested HTML tags, missing semicolons in entities, ES6 template literals, and obfuscated event handlers, requiring recursive decoding and extensive regex refining.

Session Fixation: Session handling has repeatedly suffered from weak generation and validation logic. Vulnerabilities included inverted AJAX checks that prevented ID regeneration, predictable IDs, and drivers initiating operations before validating the session identifier format.

Arbitrary File Upload: The file upload component historically trusted client-side headers and failed to reject files failing XSS/extension validation. Attackers could upload malicious files via uppercase extension bypasses or Apache double-extension tricks (e.g., '.php.jpg').