🚨 [security] [php] Update symfony/http-foundation 7.1.6 → 7.1.7 (patch) #140
Conversation
![depfu[bot]](https://avatars.githubusercontent.com/in/715?s=60&v=4){kind=small}
|
By default, I don't review pull requests opened by bots. If you would like me to review this pull request anyway, you can request a review via the |
|
Review changes with |
|
Open Redirect
DescriptionOpen Redirects, otherwise known as Unvalidated Redirects and Forwards, are a class of vulnerability made possible when a web application, comprised of insufficient input-validation controls, is manipulated into redirecting unwitting users of the application to a malicious, attacker-controlled URL. This type of exploit is popular with criminals involved in phishing and credential theft, unsurprising given the false layer of trust attributed to the fact that the modified link and the original site share the same server name. Read moreImpactThere are many overlapping techniques criminals employ to dupe unwitting victims into handing over their hard-earned cash. One of these methods is undoubtedly betting on the misplaced trust many of us place in familiar server names. This write-up exemplifies how even the most arguably well-known URL of all, In addition, Open Redirect vulnerabilities can:
ScenariosAs outlined above, attackers often use this attack as it 'hijacks' the trust users place in a well-known URL. Here's a topical example from 2021; if the target domain is Attackers send links like the one above in phishing campaigns in the hopes that they will lure a victim into clicking on the link. PreventionThe following measures can be applied to either eliminate or drastically reduce the potential for Open Redirect exploitation:
TestingVerify that URL redirects and forwards only allow destinations which appear on an allow list, or show a warning when redirecting to potentially untrusted content.
|
Reviewer's Guide by SourceryThis security update addresses a vulnerability in symfony/http-foundation where the Request class could be tricked into redirecting users to malicious domains due to improper URI parsing. The update also includes a fix for SplTempFileObject support in BinaryFileResponse. Class diagram for symfony/http-foundation updateclassDiagram
class Request {
+create(uri: String)
+assertValidUri(uri: String)
}
note for Request "The create method now asserts the URI does not contain invalid characters."
class BinaryFileResponse {
+supportSplTempFileObject()
}
note for BinaryFileResponse "Fix support for SplTempFileObject."
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
👋 Hi there!Everything looks good!
|
Please double check the following review of the pull request:Issues counts
Changes in the diffSince the diff provided is empty, there are no changes to summarize. Identified IssuesThere are no identified issues because the diff is empty. Missing TestsSince there are no changes in the diff, there are no missing tests to generate. Summon me to re-review when updated! Yours, Gooroo.dev |
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Potential issues, bugs, and flaws that can introduce unwanted behavior.
Code suggestions and improvements for better exception handling, logic, standardization, and consistency.
By taking these steps, you can ensure that the dependency updates made in your project maintain stability and provide long-term compatibility. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Feedback:
|
|
Here's the code health analysis summary for commits Analysis Summary
Code Coverage Report
|
github-actions
bot
added
the
size/S
gstraccini
bot
added
the
☑️ auto-merge
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
|
@depfu merge |
|
|
Infisical secrets check: ✅ No secrets leaked! 💻 Scan logs4:07PM INF scanning for exposed secrets...
4:07PM INF 134 commits scanned.
4:07PM INF scan completed in 356ms
4:07PM INF no leaks found
|
guibranco
deleted the
depfu/update/composer/symfony/http-foundation-7.1.7
branch
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
Security Advisories 🚨
🚨 Symfony vulnerable to open redirect via browser-sanitized URLs
Release Notes
7.1.7
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 11 commits:
[HttpFoundation] Fix mergeMerge branch '6.4' into 7.1Merge branch '5.4' into 6.4security #cve-2024-50345 [HttpFoundation] Reject URIs that contain invalid characters (nicolas-grekas)bug #58712 [HttpFoundation] Fix support for `\SplTempFileObject` in `BinaryFileResponse` (elementaire)Fix support for \SplTempFileObject in BinaryFileResponseMerge branch '6.4' into 7.1Merge branch '5.4' into 6.4[HttpFoundation] Reject URIs that contain invalid characters[HttpFoundation] Remove invalid HTTP method from exception messageEnsure compatibility with mongodb v2Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands
Summary by Sourcery
Update symfony/http-foundation from version 7.1.6 to 7.1.7 to address a security vulnerability related to open redirects and fix a bug with \SplTempFileObject support in BinaryFileResponse.
Bug Fixes:
Enhancements: