Package Instance

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

Improper Input Validation
In Symfony, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users.

Information Exposure Through an Error Message
In Symfony, some properties of the `Exception` were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace was displayed in a non-debug configuration. The `ErrorHandler` now escapes alls properties of the exception, and the stacktrace is only displayed in debug configurations.

Information Exposure
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that status codes are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist.

Symfony vulnerable to open redirect via browser-sanitized URLs
The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain.