bleedingdeacons / confur / 32044877006

95%

push

github

fix: escape anchor markup and tighten the status page gate (#65)

Three security fixes on the Confur status screen, found in a suite-wide
audit.

HtmlHelper::createLink() interpolated $href, $class and $content into an
<a> tag with no escaping. Its output is echoed raw on the status page
(the phpcs:ignore there suppressed the warning that would have caught
it), and its inputs are meeting contact names, telephone numbers and
registration email addresses read from post meta. Anyone able to edit a
meeting's contact fields could therefore store script that ran in the
browser of everyone who opened that screen. Sibling createEmailAnchor()
already applied esc_attr, so this was an omission rather than a policy.

href now goes through esc_url() against an explicit four-scheme
allow-list rather than the filterable wp_allowed_protocols(), class
through esc_attr(), and content through wp_kses_post(). generatePdfLink()
and createEmailAnchor() had the same unescaped $content and are fixed
alongside. The contact name, which is concatenated outside the anchor,
is escaped at its call site. The shortcode error paths escaped nothing
either, and no longer reflect attributes raw.

The status page was gated on 'read' — held by every logged-in user,
including Subscribers — on both the menu registration and the render
method, while the rest of the class already used 'edit_answers'. That
put every meeting contact's name, phone number and email one URL away
from anyone with an account. Both now require 'edit_answers'.

Separately, debug error_log() calls were writing personal data to the
PHP error log unconditionally: whole rendered email bodies with their
recipient, registrant addresses in five places, the submitted ACF
payload, and a print_r of an array keyed by email. The log is neither
access-controlled nor the audit trail — Scrutiny is — so these now
report by field key, post ID and count only.

Tests: escaping cannot be observed through wp-mocks, which stubs
esc_attr/es... (continued)

32 of 32 new or added lines in 5 files covered. (100.0%)

2264 of 2386 relevant lines covered (94.89%)

4.1 hits per line