Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
This report summarizes scanner evidence for getgrav/grav, a PHP project with 15,685 GitHub stars. SynthScan examined 171,851 lines of code across 928 source files, recording 837 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 5.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 726 finding(s).
Are imports declared and package/API names verified? 111 finding(s).
Are wrappers, guards, and repeated structures necessary? 659 finding(s).
Which changes need focused human review? 837 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 837 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/phpstan/classes/Grav/UtilsPathinfoExtension.php | 30 | public function getTypeFromStaticMethodCall( | CODE |
| LOW | tests/unit/Grav/RouterTest.php | 18 | public function testKeepsRestrictedFilesBehindGrav(): void | CODE |
| LOW | …nit/Grav/Framework/File/Formatter/CsvFormatterTest.php | 10 | public function testEncodeWithAssocColumns(): void | CODE |
| LOW | …nit/Grav/Framework/File/Formatter/CsvFormatterTest.php | 29 | public function testEncodeWithIndexColumns(): void | CODE |
| LOW | …nit/Grav/Framework/Flex/FlexModuleContentCacheTest.php | 50 | public function testModuleRenderIsNotStored(): void | CODE |
| LOW | …nit/Grav/Framework/Flex/FlexModuleContentCacheTest.php | 62 | public function testRegularPageRenderIsNotStored(): void | CODE |
| LOW | tests/unit/Grav/Framework/Flex/FlexPageSearchTest.php | 30 | public function testPageSearchMatchesTheKey(): void | CODE |
| LOW | tests/unit/Grav/Framework/Flex/FlexPageSearchTest.php | 43 | public function testOtherTypesKeepTheirSearch(): void | CODE |
| LOW | tests/unit/Grav/Framework/Acl/AccessTest.php | 49 | public function testDeniedRunDoesNotAllowLaterLetters(): void | CODE |
| LOW | tests/unit/Grav/Framework/Acl/AccessTest.php | 59 | public static function providerPermissionStrings(): array | CODE |
| LOW | tests/unit/Grav/Common/DebuggerCredentialsTest.php | 44 | public function testMultipartFormBodyFromTheExtension(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/DebuggerCredentialsTest.php | 71 | public function testEmptyRequestGivesEmptyCredentials(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/DebuggerCredentialsTest.php | 78 | public function testLoopbackRequestWithoutConfiguredTokenIsDenied(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/DebuggerCredentialsTest.php | 83 | public function testLoopbackRequestWithoutPresentedTokenIsDenied(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/DebuggerCredentialsTest.php | 88 | public function testRawConfiguredTokenIsAccepted(): void | CODE |
| LOW | tests/unit/Grav/Common/UtilsTest.php | 224 | public function testGetMimeByExtensionHonoursMediaTypesOverride(): void | CODE |
| LOW | tests/unit/Grav/Common/UtilsTest.php | 309 | public function testPathPrefixedByLangCode(): void | CODE |
| LOW | tests/unit/Grav/Common/UtilsTest.php | 589 | public function testUrlWithRootDoesNotStripMatchingSegmentFromTheMiddle(): void | CODE |
| LOW | tests/unit/Grav/Common/UtilsTest.php | 606 | public function testUrlKeepsQueryAndFragmentWhilePageStillResolves(): void | CODE |
| LOW | tests/unit/Grav/Common/UtilsTest.php | 656 | public function testUrlResolvesPagesOnSubfolderInstall(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ThemesTest.php | 54 | public function testInitThemeRegistersBlueprintsWithoutPagesDirectory(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ThemesTest.php | 63 | public function testInitThemeStillRegistersPageBlueprints(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ThemesTest.php | 72 | public function testInitThemeRegistersMultipleNamespacesIndependently(): void | CODE |
| LOW | tests/unit/Grav/Common/ThemesTest.php | 90 | public function testInitThemeDoesNotMountRootLevelBlueprintsAtStreamRoot(): void | CODE |
| LOW | tests/unit/Grav/Common/ThemesTest.php | 108 | public function testThemePageBlueprintExtendsSystemDefaultWithoutRecursion(): void | CODE |
| LOW | tests/unit/Grav/Common/GravRedirectTest.php | 23 | public function testRedirectCodeIsStrippedFromRoute(string $route, int $code, string $location): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/GravRedirectTest.php | 56 | public function testRouteWithoutCodeUsesTheDefault(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/GravRedirectTest.php | 64 | public function testExplicitCodeWinsOverTheOneInTheRoute(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/GravRedirectTest.php | 72 | public function testExternalTargetKeepsItsQuery(): void | CODE |
| LOW | tests/unit/Grav/Common/UriTest.php | 948 | public function testRequestBasicCredentialsStayOutOfTheUri(): void | CODE |
| LOW | tests/unit/Grav/Common/UriTest.php | 1111 | public function testReferrerOnlyAcceptsOurOwnOrigin(): void | CODE |
| LOW | tests/unit/Grav/Common/UriTest.php | 1266 | public function testCustomBasePrefixCollision(): void | CODE |
| LOW | tests/unit/Grav/Common/UriTest.php | 1293 | public static function customBaseBoundaryProvider(): array | CODE |
| LOW | tests/unit/Grav/Common/GravOutputBuffersTest.php | 17 | public function testShutdownFlushStopsAtTheCompressionBuffer(): void | CODE |
| LOW | tests/unit/Grav/Common/GravOutputBuffersTest.php | 33 | public function testCleanDiscardsWhatItCanAndKeepsTheCompressionBuffer(): void | CODE |
| LOW | tests/unit/Grav/Common/GravOutputBuffersTest.php | 48 | public function testWhoopsCleanupStopsAtTheCompressionBuffer(): void | CODE |
| LOW | tests/unit/Grav/Common/PluginMergeConfigTest.php | 75 | public function testMergedConfigStoredInTheConfigCanBeMergedAgain($deep, array $pageSettings, array $expected): void | CODE |
| LOW | tests/unit/Grav/Common/PluginMergeConfigTest.php | 97 | public function testMergedConfigStoredInTheConfigServesAnotherPage($deep, array $pageSettings, array $expected): voi | CODE |
| LOW | tests/unit/Grav/Common/DebuggerDeprecationsTest.php | 12 | public function testRepeatedNoticesKeepOneTraceAndTheirOccurrenceCount(): void | CODE |
| LOW | tests/unit/Grav/Common/DebuggerDeprecationsTest.php | 27 | public function testDifferentMessagesFilesAndLinesRemainSeparate(): void | CODE |
| LOW | tests/unit/Grav/Common/DebuggerDeprecationsTest.php | 44 | public function testYamlNoticesAreGroupedByDocumentInsteadOfParserLocation(): void | CODE |
| LOW | tests/unit/Grav/Common/DebuggerDeprecationsTest.php | 59 | public function testDisabledDebuggerDoesNotCollectNotices(): void | CODE |
| LOW | tests/unit/Grav/Common/DebuggerDeprecationsTest.php | 67 | public function testTwigNoticesKeepDistinctTemplateLocations(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 15 | public function testUnresolvedServiceIsNotInitialized(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 23 | public function testResolvedServiceIsInitialized(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 32 | public function testDirectlyAssignedValueIsInitialized(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 45 | public function testDirectlyAssignedParameterIsInitialized(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 53 | public function testProtectedClosureIsInitialized(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 61 | public function testFactoryIsNeverInitialized(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/ContainerInitializedTest.php | 70 | public function testUnknownIdIsNotInitialized(): void | CODE |
| LOW | tests/unit/Grav/Common/SessionLazyTest.php | 43 | public function testVisitorWithoutCookieGetsNoSessionUntilAWrite(): void | CODE |
| LOW | tests/unit/Grav/Common/SessionLazyTest.php | 69 | public function testVisitorWithCookieStartsAtOnce(): void | CODE |
| LOW | tests/unit/Grav/Common/SessionLazyTest.php | 87 | public function testLogoutOfAPendingSessionStartsNothing(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/SessionLazyTest.php | 99 | public function testLoginStartsTheSessionBeforeRotatingItsId(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/SessionLazyTest.php | 109 | public function testAskingForTheIdStartsTheSession(): void | CODE |
| LOW⚡ | tests/unit/Grav/Common/SessionLazyTest.php | 119 | public function testMessagesStartTheSessionOnlyWhenOneIsAdded(): void | CODE |
| LOW | tests/unit/Grav/Common/SessionLazyTest.php | 139 | public function testMessagesAreNotSerializedWithTheirCallback(): void | CODE |
| LOW | tests/unit/Grav/Common/SessionLazyTest.php | 149 | public function testNonceStartsThePendingSession(): void | CODE |
| LOW | tests/unit/Grav/Common/DebuggerFlexRenderHintsTest.php | 31 | public function testOffByDefaultEvenWithDebuggerOn(): void | CODE |
| LOW | tests/unit/Grav/Common/DebuggerFlexRenderHintsTest.php | 40 | public function testNeedsBothTheDebuggerAndTheSetting(): void | CODE |
| 599 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …/unit/Grav/Common/Page/Markdown/MarkdownOutputTest.php | 156 | self::assertStringContainsString("---\n\n# Item 1\n\nLorem ipsum", $document); | CODE |
| LOW⚡ | …nit/Grav/Common/Page/Medium/MediaMetadataQueryTest.php | 64 | $this->assertSame(['photo2.jpg'], $this->names($this->media->filterBy('copyright', 'Jane Doe', '!='))); | CODE |
| LOW⚡ | …nit/Grav/Common/Page/Medium/MediaMetadataQueryTest.php | 69 | $this->assertSame(['photo1.jpg', 'photo3.jpg'], $this->names($this->media->filterBy('copyright', 'Jane Doe'))); | CODE |
| LOW⚡ | …nit/Grav/Common/Page/Medium/MediaMetadataQueryTest.php | 91 | $this->names($this->media->where(['copyright' => 'Jane Doe', 'rating' => 5])) | CODE |
| LOW⚡ | …nit/Grav/Common/Page/Medium/MediaMetadataQueryTest.php | 96 | $this->names($this->media->where(['copyright' => 'Jane Doe', 'rating' => [1, 5]])) | CODE |
| LOW⚡ | …nit/Grav/Common/Page/Medium/MediaMetadataQueryTest.php | 128 | $this->assertSame(['photo1.jpg', 'photo3.jpg'], $this->names($groups['Jane Doe'])); | CODE |
| LOW⚡ | …s/unit/Grav/Common/Page/Medium/MediumMagicCallTest.php | 69 | $this->assertSame('Jane Doe', $this->render('{{ image.copyright }}', $medium)); | CODE |
| LOW | tests/unit/Grav/Common/File/CompiledFileTest.php | 143 | $lines[] = " help: " . str_repeat('lorem ipsum dolor sit amet ', 3); | CODE |
| LOW | tests/unit/Grav/Common/File/CompiledFileTest.php | 143 | $lines[] = " help: " . str_repeat('lorem ipsum dolor sit amet ', 3); | CODE |
| LOW | …ts/unit/Grav/Common/Security/FileCacheSecurityTest.php | 134 | $cache->set('alpha', 'placeholder'); // create the file so getFile() path exists | CODE |
| LOW | …mmon/Security/BlueprintDynamicConfigProvenanceTest.php | 88 | self::assertNotSame('S3CRET-security', $fields['salt']['placeholder'] ?? null); | CODE |
| LOW | …mmon/Security/BlueprintDynamicConfigProvenanceTest.php | 109 | self::assertSame('S3CRET-security', $fields['salt']['placeholder'] ?? null); | CODE |
| LOW | …ts/unit/Grav/Common/Twig/Sandbox/SandboxConfigTest.php | 31 | 'user' => 'admin@example.com', | CODE |
| LOW⚡ | tests/unit/Grav/Common/Data/ValidationLengthTest.php | 20 | $value = str_repeat("Lorem ipsum dolor sit amet.\n", 20000); | CODE |
| LOW⚡ | tests/unit/Grav/Common/Data/ValidationLengthTest.php | 20 | $value = str_repeat("Lorem ipsum dolor sit amet.\n", 20000); | CODE |
| LOW | tests/fake/nested-site/user/pages/01.item1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | tests/fake/nested-site/user/pages/01.item1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/01.item1/01.item1-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/01.item1/01.item1-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/01.item1-1/02.item1-1-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/01.item1-1/02.item1-1-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/01.item1-1/01.item1-1-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/01.item1-1/01.item1-1-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/01.item1-1/03.item1-1-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/01.item1-1/03.item1-1-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/01.item1/03.item1-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/01.item1/03.item1-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/03.item1-3/02.item1-3-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/03.item1-3/02.item1-3-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/03.item1-3/01.item1-3-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/03.item1-3/01.item1-3-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/03.item1-3/03.item1-3-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/03.item1-3/03.item1-3-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/01.item1/02.item1-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/01.item1/02.item1-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/02.item1-2/01.item1-2-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/02.item1-2/01.item1-2-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/02.item1-2/03.item1-2-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/02.item1-2/03.item1-2-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/02.item1-2/02.item1-2-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/01.item1/02.item1-2/02.item1-2-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | tests/fake/nested-site/user/pages/02.item2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | tests/fake/nested-site/user/pages/02.item2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/02.item2/01.item2-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/02.item2/01.item2-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/01.item2-1/02.item2-1-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/01.item2-1/02.item2-1-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/01.item2-1/03.item2-1-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/01.item2-1/03.item2-1-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/01.item2-1/01.item2-1-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/01.item2-1/01.item2-1-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/02.item2/03.item2-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/02.item2/03.item2-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/03.item2-3/02.item2-3-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/03.item2-3/02.item2-3-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/03.item2-3/03.item2-3-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/03.item2-3/03.item2-3-3/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/03.item2-3/01.item2-3-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …user/pages/02.item2/03.item2-3/01.item2-3-1/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| LOW | …/nested-site/user/pages/02.item2/02.item2-2/default.md | 5 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod | CODE |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bin/test-selfupgrade.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/functional.suite.yml | 1 | # Codeception Test Suite Configuration | COMMENT |
| LOW | tests/unit/Grav/Common/Security/TwigSandboxTest.php | 421 | // | COMMENT |
| LOW | tests/fake/htaccess-2.2.3.txt | 1 | <IfModule mod_rewrite.c> | COMMENT |
| LOW | tests/fake/htaccess-2.2.3.txt | 21 | # RewriteCond %{HTTP:X-Forwarded-Proto} https | COMMENT |
| LOW | tests/fake/htaccess-2.2.3.txt | 41 | # Return 403 Forbidden header and show the content of the root homepage | COMMENT |
| LOW | tests/fake/htaccess-2.2.3.txt | 61 | # Block all direct access to these sensitive user folders, whatever the file type | COMMENT |
| LOW | tests/fake/htaccess-2.2.3.txt | 101 | </IfModule> | COMMENT |
| LOW | tests/fake/htaccess-user-env.txt | 1 | # Deny direct web access to the sensitive folders inside each environment: | COMMENT |
| LOW | system/blueprints/config/system.yaml | 2201 | accounts.avatar: | COMMENT |
| LOW | system/blueprints/config/system.yaml | 2221 | # type: section | COMMENT |
| LOW | system/config/site.yaml | 21 | # '/old/(.*)': '/new/$1' # Would redirect /old/my-page to /new/my-page | COMMENT |
| LOW | system/config/security.yaml | 1 | # XSS heuristics (Security::detectXss and friends). | COMMENT |
| LOW | system/config/security.yaml | 81 | - xht | COMMENT |
| LOW | system/config/security.yaml | 101 | # markup can never trip it, and there is no render-time cost. (GHSA-2c4f-86xc-cr74) | COMMENT |
| LOW | system/config/security.yaml | 121 | # page-edit access (or anyone who compromises the file system) can | COMMENT |
| LOW | system/config/security.yaml | 141 | # Twig sandbox allowlists & config redaction now ship as code defaults in | COMMENT |
| LOW | system/config/security.yaml | 161 | # the defaults, over allowed_* additions, and over plugin event additions. | COMMENT |
| LOW | system/config/security.yaml | 181 | # canonical absolute path. | COMMENT |
| LOW | system/config/system.yaml | 61 | # (this is a single checkboxes field in the blueprint, not a deep-merged | COMMENT |
| LOW | …/Grav/Framework/Flex/Pages/Traits/PageContentTrait.php | 681 | $config = $grav['config']; | COMMENT |
| LOW | system/src/Grav/Common/Grav.php | 561 | // A redirect or an early close is still a finished request: the slow | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 301 | return $char === false ? "\u{FFFD}" : $char; | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 321 | // A space cannot: `java script:` is not a scheme to any browser. | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 341 | $protocol_url_regex = '#(?<![a-z0-9\s.])(' . $protocol_alt . ')(:|\&\#58)\S.*?#iUu'; | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 361 | // | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 381 | // `=`, exactly as the HTML tokenizer does. The GHSA-269c pattern | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 401 | 'on_events' => '#<(?:=\s*"[^">]*>[^"]*"|=\s*\'[^\'>]*>[^\']*\'|[^<>])*?(?:[\s\x00-\x20\"\'\/]|=\s*"[^"]*"|=\ | COMMENT |
| LOW | system/src/Grav/Common/Security.php | 681 | COMMENT | |
| LOW | system/src/Grav/Common/Security.php | 701 | // | COMMENT |
| LOW | system/src/Grav/Common/Page/Page.php | 981 | $process_markdown = $this->shouldProcess('markdown'); | COMMENT |
| LOW | system/src/Grav/Common/Page/Markdown/Excerpts.php | 301 | // applied to image media. Applying it to audio, video or a document | COMMENT |
| LOW | system/src/Grav/Common/Page/Markdown/Excerpts.php | 381 | // 1. It fails RFC 3986 scheme grammar - a real scheme always | COMMENT |
| LOW | system/src/Grav/Common/Page/Medium/ImageMedium.php | 381 | $grav = $this->getGrav(); | COMMENT |
| LOW | system/src/Grav/Common/Config/Setup.php | 461 | COMMENT | |
| LOW | system/src/Grav/Common/Twig/Twig.php | 221 | if (empty($params['autoescape'])) { | COMMENT |
| LOW | system/src/Grav/Common/Twig/Twig.php | 421 | // the @Page: source stays stable (the raw body) rather than | COMMENT |
| LOW | system/src/Grav/Common/Twig/Extension/GravExtension.php | 341 | protected function assertSandboxDumpSafe(Environment $env, bool $isSandboxed, mixed $var, string $filter, bool $refl | COMMENT |
| LOW | system/src/Grav/Common/Data/Blueprint.php | 301 | // merged tree and can no longer distinguish one source from another. | COMMENT |
| LOW | system/src/Grav/Common/Data/Blueprint.php | 741 | if (!$trusted && !isset(self::$allowedDynamicCallables[strtolower(ltrim($function, '\\'))])) { | COMMENT |
| LOW | system/src/Grav/Common/Assets/BaseAsset.php | 141 | COMMENT | |
| LOW | …stem/src/Grav/Installer/updates/1.8.0_2026-06-26_0.php | 41 | * correct on every platform. Every rewrite below is idempotent. | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/1.8.0_2026-08-13_0.php | 41 | COMMENT | |
| LOW | …stem/src/Grav/Installer/updates/2.1.5_2026-09-14_0.php | 61 | 'user/.htaccess' => <<<'HTACCESS' | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.1.5_2026-09-14_0.php | 121 | # Deny all direct web access to this folder and everything beneath it. | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.1.6_2026-09-14_0.php | 61 | // the same carve-out before 2026-06-26 widened it | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.1.6_2026-09-14_0.php | 101 | COMMENT | |
| LOW | …stem/src/Grav/Installer/updates/2.1.6_2026-09-14_0.php | 141 | </IfModule> | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/1.8.0_2026-06-30_0.php | 21 | // Avatar image extensions that may be served from user/accounts/avatars. SVG is | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.1_2026-09-25_0.php | 81 | # FileInfo` (getgrav/grav#4309, #4311). mod_alias is FileInfo-class, leaves the | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.1_2026-09-25_0.php | 101 | # subdirectories instead of being replaced, so a plugin or theme that ships its | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.1_2026-09-25_0.php | 121 | # Defense-in-depth backup for the rules in the site root .htaccess. | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.1_2026-09-25_0.php | 141 | # Data files (.yaml/.json/.md), databases, keys and tokens stay blocked. | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.0_2026-09-23_0.php | 61 | # Deny all direct web access to this folder and everything beneath it. | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.0_2026-09-23_0.php | 81 | </IfModule> | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.0_2026-09-23_0.php | 121 | COMMENT | |
| LOW | …stem/src/Grav/Installer/updates/2.2.0_2026-09-23_0.php | 141 | # Deliberately unanchored. These rules only run for requests that resolve into | COMMENT |
| LOW | …stem/src/Grav/Installer/updates/2.2.0_2026-09-23_0.php | 181 | 'user/data/.htaccess' => <<<'HTACCESS' | COMMENT |
| LOW | webserver-configs/htaccess.txt | 1 | <IfModule mod_rewrite.c> | COMMENT |
| LOW | webserver-configs/htaccess.txt | 21 | # RewriteCond %{HTTP:X-Forwarded-Proto} https | COMMENT |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | system/assets/jquery/jquery-2.x.min.js | 3 | }catch(e){}O.set(a,b,c)}else c=void 0;return c}n.extend({hasData:function(a){return O.hasData(a)||N.hasData(a)},data:fun | CODE |
| CRITICAL | system/assets/jquery/jquery-3.x.min.js | 2 | !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):f | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bin/test-selfupgrade.sh | 2 | # Local self-upgrade test harness. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | system/src/Grav/Common/Utils.php | 110 | // If URL has a scheme, we need to check if it's one of Grav streams. | COMMENT |