In addition to the redesigned logs panel, Symfony 5.4 includes other improvements related to the Symfony profiler.
Conditional profiling
Contributed by Kévin Dunglas
in #43138.Symfony profiler provides an immense amount of debug information to quickly find the cause of any problem. However, that comes at a price, because the profiler must collect all that information while serving the r
The SymfonyWorld Online 2021 Winter Edition conference will take place in just two weeks, on December 9-10, 2021. The event includes 25 talks covering a wide range of topics related to Symfony and its ecosystem: Talks are in English and they provide manually-reviewed subtitles in English; You won't miss a talk, because all of them are recorded in video and published for attendees right after the conference; You can watch the talk videos as many times as you want after the event
Configurable handlers with PHP attributes
Contributed by Alireza Mirsepassi
in #43588.PHP attributes are a great way of adding metadata to PHP code. In Symfony we're adding the option of using PHP attributes to configure most things. That's why in Symfony 5.4 we're allowing to configure message handlers with attributes. Instead of having to implement the MessageHandlerInterface, you can
Symfony 4.4.35 has just been released. Here is a list of the most important changes: security #cve-2021-41270 [Serializer] Use single quote to escape formulas (@jderusse) bug #44232 [Cache] fix connecting to local Redis sockets (@nicolas-grekas) bug #44204 [HttpClient] fix closing curl multi handle when destructing client (@nicolas-grekas) bug #44208 [Process] exclude argv/argc from possible default env vars (@nicolas-grekas) Want to upgrade to this new release? Because Symfony
Symfony 5.3.12 has just been released. Here is a list of the most important changes: security #cve-2021-41268 [SecurityBundle] Default signature_properties to the previous behavior (@wouterj) security #cve-2021-41267 [HttpKernel] Fix missing extra trusted header in sub-request (@jderusse) security #cve-2021-41270 [Serializer] Use single quote to escape formulas (@jderusse) bug #44232 [Cache] fix connecting to local Redis sockets (@nicolas-grekas) bug #44204 [HttpClient] fix clos
Symfony 6.0.0-RC1 has just been released. Here is a list of the most important changes: security #cve-2021-41268 [SecurityBundle] Default signature_properties to the previous behavior (@wouterj) security #cve-2021-41267 [HttpKernel] Fix missing extra trusted header in sub-request (@jderusse) security #cve-2021-41270 [Serializer] Use single quote to escape formulas (@jderusse) bug #44230 [Console] Add Suggestion class for more advanced completion suggestion (@wouterj) bug #44232
Symfony 5.4.0-RC1 has just been released. Here is a list of the most important changes: security #cve-2021-41268 [SecurityBundle] Default signature_properties to the previous behavior (@wouterj) security #cve-2021-41267 [HttpKernel] Fix missing extra trusted header in sub-request (@jderusse) security #cve-2021-41270 [Serializer] Use single quote to escape formulas (@jderusse) bug #44230 [Console] Add Suggestion class for more advanced completion suggestion (@wouterj) bug #44232
Description
CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with = is interpreted by the software as a formula and could be abused by an attacker.
In Symfony 4.1, we've added the opt-in csv_escape_formulas option in CsvEncoder, to prefix all cells starting by =, +, - or @ by a tab \t.
Since then, OWASP added 2 chars in that list:
- Tab (0x09)
- Carriage ret
Description
When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded-* HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks.
In Symfony 5.2, we've added support for the X-Forwarded-Prefix header, but this header was accessible in sub-requests, even if it was not part of the "trusted_headers" allowed list. An attacker could le
Description
Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password.
Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.
Resolution
Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.
T
