Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

phacility/phabricator

              master @ 5720a38
            

220

Fixes

CVEs

CRITICAL

Peak severity

22.2%

Coverage

Highlights

Auth Bypass: 71 prior fixes. Scrutinize any change in this area.

src/applications/auth/engine/PhabricatorAuthSessionEngine.php: most-fixed (8 issues). Treat as high-risk during review.

129 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The most frequent vulnerability class, with fixes scattered across policy filtering, query execution, and transaction editors. Many bypasses stem from missing viewer context, incorrect capability checks, or state leakage between evaluations.

Reflected XSS: Systemic output encoding failures across many view components, leading to a broad migration to auto-escaping helpers. User-controlled data (titles, file names, descriptions) was frequently concatenated into HTML without escaping.

CSRF: CSRF protection was inconsistently applied, with a global write guard added late but many endpoints still requiring individual fixes. Missing isFormPost checks and token validation allowed state-changing requests via GET or forged posts.