sylius/resource-bundle

Simpler CRUD for Symfony applications

View on Packagist

View on Github

Activity

Latest release: Jun 22, 2026
Total releases: 160
Cadence: ~18 days
Last 12 months: 5

Reach

Stars: 236

Details

License: MIT
First release: Apr 24, 2013

Releases

Version	Released
`v1.14.2` patch	Jun 22, 2026
`v1.14.1` patch	Mar 02, 2026
`v1.14.0` minor	Feb 03, 2026
`v1.14.0-ALPHA.1` pre	Jan 05, 2026
`v1.13.1` patch	Sep 24, 2025
`v1.13.0` minor	Jun 04, 2025
`v1.13.0-BETA.1` pre	May 28, 2025
`v1.12.2` patch	May 28, 2025
`v1.13.0-ALPHA.3` pre	Mar 12, 2025
`v1.13.0-ALPHA.2` pre	Jan 21, 2025
`v1.12.1` patch	Jan 21, 2025
`v1.13.0-ALPHA.1` pre	Jan 17, 2025
`v1.12.0` minor	Oct 08, 2024
`v1.12.0-BETA.2` pre	Oct 07, 2024
`v1.11.4` patch	Oct 07, 2024
`v1.12.0-BETA.1` pre	Oct 01, 2024
`v1.12.0-ALPHA.3` pre	Sep 23, 2024
`v1.11.3` patch	Sep 23, 2024
`v1.12.0-ALPHA.2` pre	Sep 12, 2024
`v1.12.0-ALPHA.1` pre	Sep 09, 2024
`v1.11.2` patch	Sep 06, 2024
`v1.11.1` patch	Sep 02, 2024
`v1.11.0` minor	Aug 29, 2024
`v1.11.0-RC.2` pre	Jul 12, 2024
`v1.11.0-RC.1` pre	Jul 11, 2024
`v1.11.0-BETA.2` pre	May 14, 2024
`v1.11.0-BETA.1` pre	Apr 19, 2024
`v1.11.0-ALPHA.2` pre	Jan 30, 2024
`v1.10.3` patch	Dec 01, 2023
`v1.11.0-ALPHA.1` pre	Jun 22, 2023
`v1.10.2` patch	Jan 04, 2023
`v1.10.1` patch	Dec 05, 2022
`v1.10.0` minor	Oct 31, 2022
`v1.10.0-BETA.1` pre	Oct 18, 2022
`v1.10.0-ALPHA.2` pre	Sep 09, 2022
`v1.10.0-ALPHA.1` pre	May 16, 2022
`v1.9.1` patch	May 16, 2022
`v1.8.4` patch	Apr 11, 2022
`v1.9.0` minor	Apr 07, 2022
`v1.8.3` patch	Apr 07, 2022
`v1.9.0-RC.1` pre	Feb 28, 2022
`v1.9.0-BETA.1` pre	Feb 10, 2022
`v1.9.0-ALPHA.1` pre	Jan 25, 2022
`v1.8.2` patch	Apr 08, 2021
`v1.8.1` patch	Mar 19, 2021
`v1.8.0` minor	Mar 19, 2021
`v1.7.1` patch	Dec 09, 2020
`v1.7.0` minor	Dec 08, 2020
`v1.7.0-RC.8` pre	Dec 07, 2020
`v1.7.0-RC.7` pre	Dec 07, 2020

1–50 of 160

Repository

sylius/syliusresourcebundle

Forks: 167
Open issues: 61
Language: PHP

sylius
resource
hacktoberfest

Dependencies (23)

Depends on

v1.14.2

babdev/pagerfanta-bundle ^4.4
doctrine/collections ^2.2
doctrine/event-manager ^1.1 || ^2.0
doctrine/inflector ^2.0
doctrine/persistence ^3.3 || ^4.0
sylius/registry ^1.2
symfony/config ^6.4 || ^7.4 || ^8.0
symfony/deprecation-contracts ^3.5
symfony/expression-language ^6.4 || ^7.4 || ^8.0
symfony/form ^6.4 || ^7.4 || ^8.0

1–10 of 23

Used by

Supply-chain exposure

4 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

GHSA-65v7-wg35-2qpm May 29, 2024

Sylius Resource Bundle Cross-Site Request Forgery vulnerability

6.5 / 10
Medium
Network Low None Required Unchanged None High None

Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue.

This issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed.

Description

The following actions in the admin panel did not require a CSRF token:

marking order’s payment as completed

marking order’s payment as refunded

marking product review as accepted

marking product review as rejected

Resolution

The issue is fixed by adding a required CSRF token to those actions.

We also fixed ResourceController‘s applyStateMachineTransitionAction method by adding a CSRF token check. If you use that action in the API context, you can disable it by adding csrf_protection: false to its routing configuration

Affected versions

v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.15v1.0.16v1.0.2v1.0.3v1.0.4

+ 16 more Show less

v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.1v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.2.0v1.2.1

Fixed in

1.0.171.1.91.2.2

References

https://github.com/Sylius/SyliusResourceBundle/commit/9720ac5a0a39ea2c2a395ef16a94a00aa86c418b
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/2018-07-09.yaml
https://github.com/Sylius/SyliusResourceBundle
https://sylius.com/blog/csrf-vulnerability-in-admin-panel

Updated Dec 04, 2024 · Source: OSV.dev
CVE-2020-15143 GHSA-p4pj-9g59-4ppv Aug 19, 2020

Remote Code Execution in SyliusResourceBundle

7.7 / 10
High
Network Low Low None Changed None High None

Impact

Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: <=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3.

Example

foo: path: /foo/{id} defaults: _sylius: repository: method: findSome arguments: entity: "expr:service('repository').find($id)"

In this case, $id can be prepared in a way that calls other services.

If you visit /foo/"~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~", it will result in a following expression expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~""), which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Workarounds

The fix requires adding addslashes in ParametersParser::parseRequestValueExpression to sanitize user input before evaluating it using the expression language.

- return is_string($variable) ? sprintf('"%s"', $variable) : $variable; + return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;

Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

For more information

If you have any questions or comments about this advisory:

Email us at security@sylius.com

Affected versions

v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4v1.4.5v1.4.6v1.5.0v1.5.1v1.6.0v1.6.1v1.6.2

+ 74 more Show less

v1.6.3v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12v1.1.13v1.1.14v1.1.15v1.1.17v1.1.18v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9v1.2.0v1.2.0-BETAv1.2.0-RCv1.2.1v1.2.10v1.2.11v1.2.12v1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9v1.3.0v1.3.0-BETAv1.3.1v1.3.10v1.3.11v1.3.12v1.3.13v1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9

Fixed in

1.3.141.4.71.5.21.6.4

References

https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv
https://nvd.nist.gov/vuln/detail/CVE-2020-15143
https://github.com/Sylius/SyliusResourceBundle/commit/73ed8b8bb083f36c30ad7c3cec336f65d6a80650
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-15143.yaml
https://github.com/Sylius/SyliusResourceBundle

Updated Jul 08, 2026 · Source: OSV.dev
CVE-2020-15146 GHSA-h6m7-j4h3-9rf5 Aug 19, 2020

Remote Code Execution in SyliusResourceBundle

9.6 / 10
Critical
Network Low Low None Changed High High None

Impact

Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: <=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3.

Example

sylius_grid: grids: foo: fields: bar: options: baz: "expr:service('sylius.repository.product').find($id)"

In this case, $id can be prepared in a way that calls other services.

If you visit /route?id="~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~", it will result in a following expression expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~""), which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Workarounds

The fix requires adding addslashes in OptionsParser::parseOptionExpression to sanitize user input before evaluating it using the expression language.

- return is_string($variable) ? sprintf('"%s"', $variable) : $variable; + return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;

Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

For more information

If you have any questions or comments about this advisory:

Email us at security@sylius.com

Affected versions

v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4v1.4.5v1.4.6v1.5.0v1.5.1v1.6.0v1.6.1v1.6.2

+ 74 more Show less

v1.6.3v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12v1.1.13v1.1.14v1.1.15v1.1.17v1.1.18v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9v1.2.0v1.2.0-BETAv1.2.0-RCv1.2.1v1.2.10v1.2.11v1.2.12v1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9v1.3.0v1.3.0-BETAv1.3.1v1.3.10v1.3.11v1.3.12v1.3.13v1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9

Fixed in

1.3.141.4.71.5.21.6.4

References

https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5
https://nvd.nist.gov/vuln/detail/CVE-2020-15146
https://github.com/Sylius/SyliusResourceBundle/commit/73d9aba182947473a5935b31caf65ca263091e00
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-15146.yaml
https://github.com/Sylius/SyliusResourceBundle

Updated Mar 13, 2026 · Source: OSV.dev
CVE-2020-5218 GHSA-8vp7-j5cj-vvm2 CVE-2020-5220 GHSA-prg5-hg25-8grq Jan 31, 2020

Ability to expose data in Sylius by using an unintended serialisation group

4.4 / 10
Medium
Network High Low Required Changed Low Low None

Impact

ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.

Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2.

Patches

The patch is provided for ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

After it is applied, It allows to choose only the groups that are defined in serialization_groups or allowed_serialization_groups route definition. Any group not defined in those will not be used.

This behaviour might be a BC break for those using custom groups via the HTTP header, please adjust allowed_serialization_groups accordingly.

Workarounds

Service sylius.resource_controller.request_configuration_factory can be overridden with an implementation copied from \Sylius\Bundle\ResourceBundle\Controller\RequestConfigurationFactory where the part that handles custom serialisation groups is deleted.

Affected versions

v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4v1.4.5v1.5.0v1.6.0v1.6.1v1.6.2v1.0.0v1.0.1

+ 70 more Show less

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12v1.1.13v1.1.14v1.1.15v1.1.17v1.1.18v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9v1.2.0v1.2.0-BETAv1.2.0-RCv1.2.1v1.2.10v1.2.11v1.2.12v1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9v1.3.0v1.3.0-BETAv1.3.1v1.3.10v1.3.11v1.3.12v1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9

Fixed in

1.3.131.4.61.5.11.6.3

References

https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2
https://nvd.nist.gov/vuln/detail/CVE-2020-5220
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2020-5220.yaml

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 31
patch 78
pre 49

160 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More