Finding ID: SEC-020
Location: lib/Admin/Controller/AbstractController.php
CVSS: 5.3
Code uses serialize() on request-derived params to build cache keys. While used only for hashing now, this pattern is dangerous and may lead to unsafe behavior if logic changes.
Impact: Potential deserialization-related risks and unsafe practices.
Remediation (short): Use json_encode with JSON_THROW_ON_ERROR for stable, safer serialization for cache keys.
Reference: SECURITY_REVIEW.md
Finding ID: SEC-020
Location: lib/Admin/Controller/AbstractController.php
CVSS: 5.3
Code uses
serialize()on request-derived params to build cache keys. While used only for hashing now, this pattern is dangerous and may lead to unsafe behavior if logic changes.Impact: Potential deserialization-related risks and unsafe practices.
Remediation (short): Use
json_encodewithJSON_THROW_ON_ERRORfor stable, safer serialization for cache keys.Reference: SECURITY_REVIEW.md