php-codeigniter-audit

PHP CodeIgniter framework security audit (php-codeigniter-audit)

Analyze the framework mechanisms and configuration pitfalls of CodeIgniter projects, with focus on:

• Whether CSRF protection is enabled and whether the token name/verification logic is correct
• Output filtering and XSS protection (whether CI's built-in filter is disabled or used incorrectly)
• Database query construction: whether user input is concatenated into $this->db->query or raw SQL
• Whether the form validator is overridden or bypassed
• Security of session cookie flags (CI session settings)

Input

User-provided:

• source_path: CodeIgniter project root directory Optional:
• output_path: output directory path (default {source_path}_audit）

Output directory

Output to:

{output_path}/framework_audit/
  codeigniter_{timestamp}.md

Framework identification (required)

Identification evidence must be provided (empty assertions are not allowed):

• Typical directories:application/、system/
• Configuration files:application/config/config.php or session/security configuration files
• Version clues:composer.json or system/core/ structure

Risk type mapping (required)

Each finding must state:

• General type code:CSRF / XSS / SQL / AUTH / CFG / SESS / LOGIC , etc.
• Mapping reason

Required audit checklist (required: check each item and output the results)

1) CSRF protection (CSRF)

Must locate and output:

• Whether CSRF is enabled (CI 3:config.php csrf configuration, CI 4: Security class configuration)
• Token name, verification entry point, and skip rules (whether verification is not enabled for certain controllers/methods)

Decision rules:

• If state-changing routes exist but CSRF is not enabled, output a CSRF risk

2) XSS output protection (XSS/CFG)

Must locate and output:

• Whether CI's XSS filter is enabled (e.g. global_xss_filtering、Security::xss_clean , etc.)
• Whether the view layer correctly applies html_escape or equivalent escaping to user input

Decision rules:

• If filtering is disabled or output is not escaped, and user input can reach view output, output XSS

3) Database query concatenation (SQL)

Must locate and output:

• Raw queries:$this->db->query($sql) or ->query($userInput) concatenation evidence
• Correct path: use of Query Builder and bound parameters

Decision rules:

• If user input enters SQL string concatenation, output a SQL risk

4) Sessions and Cookies (SESS/CFG)

Must locate and output:

• Cookie flags: HttpOnly/Secure/SameSite (if configured in the project)
• Session configuration: session timeout, fixation protection (if present)

5) Authentication and access control (AUTH)

Must locate and output:

• Access protection patterns in controllers: custom auth helper, validation in a base controller, filters
• Route-layer filters or middleware (CI 4 filters)

Decision rules:

• If a sensitive controller or method lacks unified authentication, output an AUTH risk

Observable PoC (mandatory: framework observable verification framework)

Provide at least one of the following two categories and clearly state the observation points:

• CSRF: call a state-changing route without a CSRF token, and observe whether it succeeds and its side effects
• SQL: use an injection payload to call a suspected concatenated SQL path, and observe differences in responses or error echoes

Output completeness check (mandatory)

• Output includes: check results for CSRF/XSS/SQL/Session/Auth
• Each risk includes: mapped type code + location evidence + observable verification framework + remediation recommendation