Assert For Auth Control (ARCH7133)

Key php.security.assert-for-auth-control · Severity warning · Category security · CWE CWE-617

assert() calls are skipped without evaluation when zend.assertions=-1 in production. Basing a security decision on assert means the check is entirely ignored in production, leading to an authorization bypass.

Incorrect

<?php
function deleteUser(User $actor, int $targetId): void
{
    assert($actor->isAdmin()); // stripped in production → anyone can delete
    Db::delete('users', $targetId);
}

Correct

<?php
function deleteUser(User $actor, int $targetId): void
{
    if (!$actor->isAdmin()) {
        throw new AccessDeniedException();
    }
    Db::delete('users', $targetId);
}

Fix

Always enforce authorization with an explicit if/exception check that runs in production; use assert only for development-time sanity checks.