php-symfony-audit

PHP Symfony framework security audit (php-symfony-audit)

Analyze "framework-specific security mechanisms" and "configuration/usage pitfalls" in Symfony project source code, focusing on:

• config/packages/security*.yaml correctness of access_control and firewalls configuration
• CSRF protection mechanisms (form submission and token verification)
• Twig rendering auto-escaping and raw output risks
• Symfony access expressions and security interception chain (mapped to AUTH/EXPR/TPL as appropriate)
• HttpClient outbound connection policy (SSRF-type risks mapped to the generic SSRF type)

Input

User-provided:

• source_path: Symfony project source root directory Optional:
• output_path: output directory path (default {source_path}_audit）

Output directory

Output to:

{output_path}/framework_audit/
  symfony_{timestamp}.md

Framework identification (required)

Evidence points identifying it as Symfony must be provided (no unsupported assertions allowed):

• Typical directories:config/、src/、templates/
• Dependency evidence:composer.json in symfony/framework-bundle , etc.
• Entry point evidence:public/index.php or a similar front controller

Risk type mapping (required)

Each finding must state:

• Applicable generic type codes:AUTH / CSRF / CFG / XSS / TPL / LOGIC / SESS / SSRF / EXPR , etc.
• Mapping reason: why this Symfony risk falls under that type code (in one sentence)

Mandatory audit checklist (required: check each item and output results)

1) Access control and authentication policy (AUTH)

Must locate and output:

• security.yaml the access_control rules in
• firewalls configuration (whether anonymous: true, whether stateless: true and authentication method)
• switch_user、role_hierarchy or voter/policy class configuration (if present)

Decision rules:

• If overly broad allows exist (for example, an excessively generalized anonymous rule covering sensitive paths), output an AUTH risk
• If a pattern exists with "authentication but missing role/ownership checks", output an AUTH or LOGIC risk

2) CSRF protection (CSRF)

Must locate and output:

• Symfony CSRF-related configuration (framework: csrf_protection or component-level configuration)
• How the CSRF token is generated and received in form type usage
• Handling path for token verification failure (whether it exits early, whether it is only verified in certain branches)

Decision rules:

• If "some routes/forms have CSRF disabled or the CSRF token receiving field is inconsistent", output a CSRF risk

3) Twig auto-escaping and raw output (XSS/TPL)

Must locate and output:

• Twig configuration: whether auto-escaping is disabled (globally or locally)
• Raw output points in templates:|raw、{% autoescape false %}, and any "escape-bypassing" directives
• Data source: where the raw-output variables come from (request/session/database fields)

Decision rules:

• If the source of the raw-output variable is controllable and no escaping is performed, map it to XSS or TPL (if expression execution/template engine control exists)

4) Security expressions and evaluation risks (EXPR/TPL/AUTH)

Must locate and output:

• Location where ExpressionLanguage is used for security (in voter/policy is_granted or expression conditions)
• Whether the source of the expression string may be user-controlled (e.g., expression concatenation)

Decision rules:

• If the expression string is controllable, output according to EXPR or TPL risk

5) Outbound HTTP and internal network access (SSRF)

Must locate and output (framework correlation check only):

• HttpClient/KernelInterface encapsulation entry points for outbound calls such as
• Whether the URL/host comes from user input, and whether an allowlist or internal network blocking exists

Observable PoC (mandatory: framework effect observable validation framework)

Provide at least one of the following two categories and clearly state the observation points:

• Access control errors: use an unauthenticated/low-privilege user to access a suspected protected route and observe response differences
• CSRF errors: craft a form request with a missing or forged CSRF token and observe the status code/error path

PoC output requirements:

• Must include the real route and the real form action (or route path)
• Must state the expected observation points (e.g., whether it returns 403, whether the state change continues to execute)

Output completeness check (mandatory)

• Output includes: Symfony identification evidence points
• AUTH/CSRF/Twig(raw)/security expressions/HttpClient (optional) all five blocks have check results
• Each risk has: mapping type code + location evidence + observable validation framework + remediation recommendation