php-xss-audit

PHP XSS Audit (php-xss-audit)

Analyze PHP project source code to identify cross-site scripting (XSS): user input entering output contexts without correct escaping/encoding, or frameworks disabling automatic escaping resulting in expression execution/HTML injection.

Grading and Numbering

• See:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-XSS-{序号}

XSS Sink (required)

Identify the following output points:

• Native output:echo/print/printf/<?= ?>(output variable to response)
• String concatenation to response:header() / setcookie()(if it contains controllable content)
• Template rendering:
  • Twig：{{ }}(escaped) and {% autoescape false %} / |raw risk points
  • Smarty：fetch/display and unsafe variable output
  • Blade-like:{!! !!}(unescaped output)
• Dynamic script/event attributes: output to on* attribute,<script> inside, URL parameters

Escape/Protection Check (required)

For each suspected chain, must analyze:

• Whether htmlspecialchars/htmlentities or framework automatic escaping is present
• Whether context encoding (HTML, attribute, JS, URL) is present
• Whether escaping is disabled (raw/raw filter/unescaped output)

tracer Trigger Conditions (required)

• User input undergoes multiple layers of processing and is concatenated into HTML fragments
• Branches exist: one branch escapes, another branch does not escape
• Output point is at the template layer, input is at the controller layer

Report Output

Output to:

{output_path}/vuln_audit/xss_{timestamp}.md

Vulnerability Entry Template (mandatory)

and php-sql-audit are basically consistent, but in the data flow chain must clearly specify:

• Output context: HTML body/attribute/script/URL parameter/template fragment
• Location and evidence of the specific escaping function or escaping disablement point
• PoC must include an executable XSS payload and distinguish the required encoding method

Evidence Citation (mandatory: from php-route-tracer)

Each suspected XSS vulnerability must item by item cite from the trace output ## 9) Sink Evidence Type Checklist the XSS linecorresponding evidence points (status may be pending verification, but evidence citation must exist):

1. EVID_XSS_OUTPUT_POINT: response output point location evidence (echo/template output/<script>or attribute/URL context)
2. EVID_XSS_USER_INPUT_INTO_OUTPUT: evidence of user input entering output
3. EVID_XSS_ESCAPE_OR_RAW_CONTROL: escaping/escaping disabled evidence (htmlspecialchars etc. or raw/raw mode evidence)

tracer Evidence Missing Handling (mandatory)

• If any of the above key evidence points 1~3 cannot be located: the vulnerability status can only be marked as ⚠️待验证, and must not directly give ✅已确认可利用。