PHP ThinkPHP Framework Security Audit (php-thinkphp-audit)

Analyze the "framework-specific security mechanisms" and typical pitfall patterns in ThinkPHP project source code, focusing on:

Authentication/Permission Control (auth module, controller/middleware gate)
CSRF token mechanism and bypass paths
Automatic escaping and raw output risks of ThinkPHP template engine
Mass Assignment caused by ORM/Model layer writing links (
```
allowField
```
/scenario validation)
Database native expression/raw SQL injection entry points (mapped to general SQL risks)
Debug/exception output and security configuration switches (mapped to CFG)

Input

Users provide:

```
source_path
```
: Root directory of the ThinkPHP project Optional:
```
output_path
```
: Output directory path (default
```
{source_path}_audit
```
)

Output Directory

Output to:

{output_path}/framework_audit/
  thinkphp_{timestamp}.md

Framework Identification (Mandatory)

Must provide evidence to confirm it is ThinkPHP:

Dependency evidence:
```
composer.json
```
contains dependencies related to
```
topthink/think-*
```
or
```
thinkphp/think-*
```
Entry evidence:
```
public/index.php
```
or equivalent frontend entry
Configuration evidence: ThinkPHP configuration files exist in the
```
config/
```
directory (such as
```
app.php
```
,
```
database.php
```
,
```
middleware.php
```
, etc., depending on the actual project)
Runtime directory evidence:
```
runtime/
```
directory structure (if exists)

Risk Type Mapping (Mandatory)

Each finding must specify:

General type code:
```
AUTH
```
/
```
CSRF
```
/
```
XSS
```
/
```
TPL
```
/
```
LOGIC
```
/
```
CFG
```
/
```
SESS
```
/
```
SQL
```
, etc. (select from your unified type codes)
Mapping reason: Why it falls into this type code (explain the mapping logic in one sentence)

Audit Checklist (Mandatory: Check item by item and output results)

1) Authentication and Permission Control (AUTH)

Must locate and output:

Authentication entry: Controller middleware/filter, base Controller/Behavior, routing layer permission middleware
auth module usage: Whether ThinkPHP's auth-related capabilities are used (such as
```
Auth
```
/RBAC/role permission verification functions or equivalent encapsulation)
Source of permission verification parameters: Where resource ID/user ID comes from (route parameters/request body/session), and whether ownership verification is performed

Judgment Rules:

If "only login status is checked but resource ownership/role segmentation is missing" is found, output AUTH risk
If "permission verification is missing in some branches/bypassed after exceptions" is found, output AUTH or LOGIC risk

2) CSRF Protection (CSRF)

Must locate and output:

CSRF token enablement location: Configuration item/middleware/form generation logic
Token receiving field: Which field from body/header (depending on the actual project)
Token verification logic: Verification function/middleware entry and failure handling (whether return/throw and block state changes)
Bypass rules: Which routes, request methods or scenarios skip CSRF verification

Judgment Rules:

Bypass rules exist but cover state change interfaces => CSRF risk
Token verification fails but business execution continues (e.g., exceptions are swallowed) => CSRF risk

3) Template Engine Escaping and Raw Output (XSS/TPL)

Must locate and output:

Template automatic escaping strategy: Whether template syntax is escaped by default, whether globally disabled
Raw output/escape skipping syntax: For example,
```
raw
```
/
```
|raw
```
or equivalent mechanisms exist in templates (depending on the actual template engine version and usage)
User input entering template variables: Where variables come from (request/session/db), and whether they are directly spliced into HTML/JS/attribute contexts

Judgment Rules:

If raw output variables are controllable and unescaped => map to XSS or TPL (if involving expressions/execution chains)

4) ORM Writing Links (LOGIC: Mass Assignment)

Must locate and output:

Input acquisition: Whether
```
request->param()
```
/
```
request->all()
```
/
```
$this->request->post()
```
/ equivalent structures are passed into model writing as a whole
Model writing points:
```
Model::create/save/update
```
,
```
$model->save($data)
```
, batch assignment behavior
Allowed field strategy: Whether
```
allowField
```
/
```
field
```
/scenario or equivalent whitelist mechanisms are configured

Judgment Rules:

Input is written as a whole and the model lacks sensitive field deny/allow constraints => LOGIC risk
Allowed field whitelist exists but still contains high-risk fields => LOGIC risk

5) Database Native Expression/Raw SQL Risks (SQL)

Must locate and output:

Raw SQL entry points:
```
Db::query($sql)
```
,
```
Db::execute($sql)
```
,
```
whereRaw
```
,
```
orderRaw
```
,
```
buildExpression
```
, etc. (depending on the actual project)
Evidence of user input entering native expressions: Splicing, template replacement, string assembly points
Whether parameterization/binding strategies exist:
```
->bind/placeholder/prepare
```
, etc. (depending on the actual project)

Judgment Rules:

User input enters string-spliced native SQL expressions => SQL risk

6) Security Configuration and Debug Exposure (CFG/SESS)

Must locate and output:

Debug/exception output:
```
app_debug
```
,
```
trace
```
, error page output strategy, log level (depending on the actual project)
Cookie/session security parameters: If project configuration files are visible (HttpOnly/Secure/SameSite, etc.), output SESS/CFG risk mapping

Judgment Rules:

Production debug mode enabled/stack trace displayed => CFG risk

Observable PoC (Mandatory: Framework-specific Observable Verification Framework)

Provide at least one of the following two types and clearly write down the observation points:

AUTH: Use a low-privilege user to request a suspected protected action, observe whether access is successful/whether business side effects occur
CSRF: Construct a request with missing or incorrect CSRF token for state change routes, observe whether blocking is returned and whether the business still executes

PoC Output Requirements:

Must include real routes/controller actions (extracted from your route mapping or code entry evidence)
Must include token field names/fields required for verification (output according to actual project field names)
Must explain observation points (HTTP status code, response content characteristics, whether business side effects occur)

Output Completeness Check (Mandatory)

Output includes: ThinkPHP identification evidence + six inspection results of AUTH/CSRF/template output/ORM writing/database native entry/debug configuration
Each risk has: mapped type code + location evidence + observable verification framework + repair suggestions

php-thinkphp-audit

NPX Install

Tags

SKILL.md Content (Chinese)

PHP ThinkPHP Framework Security Audit (php-thinkphp-audit)

Input

Output Directory

Framework Identification (Mandatory)

Risk Type Mapping (Mandatory)

Audit Checklist (Mandatory: Check item by item and output results)

1) Authentication and Permission Control (AUTH)

2) CSRF Protection (CSRF)

3) Template Engine Escaping and Raw Output (XSS/TPL)

4) ORM Writing Links (LOGIC: Mass Assignment)

5) Database Native Expression/Raw SQL Risks (SQL)

6) Security Configuration and Debug Exposure (CFG/SESS)

Observable PoC (Mandatory: Framework-specific Observable Verification Framework)

Output Completeness Check (Mandatory)