php-codeigniter-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

PHP CodeIgniter 框架安全审计（php-codeigniter-audit）

PHP CodeIgniter Framework Security Audit (php-codeigniter-audit)

分析 CodeIgniter 项目的框架机制与配置踩坑，重点覆盖：

CSRF 保护是否启用与 token 名称/校验逻辑是否正确
输出过滤与 XSS 防护（CI 自带过滤器是否被禁用或错误使用）
数据库查询构造：是否存在用户输入拼接到
```
$this->db->query
```
或原生 SQL
表单验证器是否被覆盖或绕过
会话 Cookie flags 安全性（CI 会话设置）

Analyze framework mechanisms and configuration pitfalls in CodeIgniter projects, focusing on:

Whether CSRF protection is enabled and whether the token name/validation logic is correct
Output filtering and XSS protection (whether CI's built-in filters are disabled or misused)
Database query construction: whether user input is spliced into
```
$this->db->query
```
or raw SQL
Whether form validators are overridden or bypassed
Security of session Cookie flags (CI session settings)

输入

Input

用户提供：

```
source_path
```
：CodeIgniter 项目根目录可选：
```
output_path
```
：输出目录路径（默认
```
{source_path}_audit
```
）

User provides:

```
source_path
```
: Root directory of the CodeIgniter project Optional:
```
output_path
```
: Output directory path (default
```
{source_path}_audit
```
)

输出目录

Output Directory

输出到：

{output_path}/framework_audit/
  codeigniter_{timestamp}.md

Output to:

{output_path}/framework_audit/
  codeigniter_{timestamp}.md

框架识别（必做）

Framework Identification (Mandatory)

必须给出识别证据（不允许空口断言）：

典型目录：
```
application/
```
、
```
system/
```
配置文件：
```
application/config/config.php
```
或会话/安全配置文件
版本线索：
```
composer.json
```
或
```
system/core/
```
结构

Identification evidence must be provided (no empty assertions allowed):

Typical directories:
```
application/
```
,
```
system/
```
Configuration files:
```
application/config/config.php
```
or session/security configuration files
Version clues:
```
composer.json
```
or structure of
```
system/core/
```

风险类型映射（必做）

Risk Type Mapping (Mandatory)

每条发现都必须写明：

通用类型码：
```
CSRF
```
/
```
XSS
```
/
```
SQL
```
/
```
AUTH
```
/
```
CFG
```
/
```
SESS
```
/
```
LOGIC
```
等
映射原因

Each finding must specify:

Common type code:
```
CSRF
```
/
```
XSS
```
/
```
SQL
```
/
```
AUTH
```
/
```
CFG
```
/
```
SESS
```
/
```
LOGIC
```
, etc.
Mapping reason

必审清单（必做：逐项检查并输出结果）

Mandatory Audit Checklist (Mandatory: Check item by item and output results)

1) CSRF 保护（CSRF）

1) CSRF Protection (CSRF)

必须定位并输出：

CSRF 是否启用（CI 3：
```
config.php
```
的 csrf 配置，CI 4：Security 类配置）
token 名称、校验入口与跳过规则（是否某些控制器/方法未启用校验）

判定规则：

存在状态变更路由但未启用 CSRF，则输出 CSRF 风险

Must locate and output:

Whether CSRF is enabled (CI 3: csrf configuration in
```
config.php
```
, CI 4: Security class configuration)
Token name, validation entry and skip rules (whether some controllers/methods have not enabled validation)

Judgment rules:

If there is a state change route but CSRF is not enabled, output CSRF risk

2) XSS 输出防护（XSS/CFG）

2) XSS Output Protection (XSS/CFG)

必须定位并输出：

CI 的 XSS 过滤器是否启用（如
```
global_xss_filtering
```
、
```
Security::xss_clean
```
等）
视图层是否对用户输入做了正确
```
html_escape
```
或等价转义

判定规则：

如果禁用过滤或未转义输出，且用户输入能进入视图输出，则输出 XSS

Must locate and output:

Whether CI's XSS filters are enabled (such as
```
global_xss_filtering
```
,
```
Security::xss_clean
```
, etc.)
Whether the view layer correctly performs
```
html_escape
```
or equivalent escaping on user input

Judgment rules:

If filtering is disabled or output is unescaped, and user input can enter view output, output XSS risk

3) 数据库查询拼接（SQL）

3) Database Query Splicing (SQL)

必须定位并输出：

原生查询：

$this->db->query($sql)

或

->query($userInput)

的拼接证据

正确路径：Query Builder 与绑定参数使用

判定规则：

若存在用户输入进入 SQL 字符串拼接，输出 SQL 风险

Must locate and output:

Raw queries: Evidence of splicing in

$this->db->query($sql)

->query($userInput)

Correct approach: Use of Query Builder and bound parameters

Judgment rules:

If user input is spliced into SQL strings, output SQL risk

4) 会话与 Cookie（SESS/CFG）

4) Session and Cookie (SESS/CFG)

必须定位并输出：

cookie flags：HttpOnly/Secure/SameSite（如在项目中配置）
session 配置：会话超时、固定防护（如存在）

Must locate and output:

Cookie flags: HttpOnly/Secure/SameSite (as configured in the project)
Session configuration: Session timeout, fixation protection (if present)

5) 鉴权与访问控制（AUTH）

5) Authentication and Access Control (AUTH)

必须定位并输出：

控制器中访问保护模式：自定义
```
auth
```
helper、基类 controller 的校验、过滤器
路由层过滤器或中间件（CI 4 filters）

判定规则：

若敏感控制器或方法缺少统一鉴权，输出 AUTH 风险

Must locate and output:

Access protection modes in controllers: Custom
```
auth
```
helper, base class controller validation, filters
Route layer filters or middleware (CI 4 filters)

Judgment rules:

If sensitive controllers or methods lack unified authentication, output AUTH risk

可观测 PoC（必做：框架特效可观测验证框架）

Observable PoC (Mandatory: Framework-specific Observable Validation Framework)

至少给出以下两类其一并写清观察点：

CSRF：缺失 CSRF token 调用状态变更路由，观察是否成功与副作用
SQL：使用注入 payload 调用疑似拼接 SQL 路径，观察返回差异或错误回显

Provide at least one of the following two types and clearly write the observation points:

CSRF: Call state change routes without CSRF token, observe success and side effects
SQL: Call suspected SQL splicing paths using injection payloads, observe return differences or error echoes

输出完整性检查（强制）

Output Integrity Check (Mandatory)

输出包含：CSRF/XSS/SQL/Session/Auth 的检查结果
每条风险都有：映射类型码 + 位置证据 + 可观测验证框架 + 修复建议

Output includes: Check results of CSRF/XSS/SQL/Session/Auth
Each risk has: Mapping type code + location evidence + observable validation framework + repair suggestions