Sanitize policy bodies at output in PolicyEndpoint::index (defense-in-depth) #40

New Issue

2026-06-10T18:50:52Z

thatguygriff commented

2026-06-10 18:50:52 +00:00

Finding (security review — Low, defense-in-depth)

assets/js/booking.js and assets/js/group-classes.js inject the policy body from GET /policies into innerHTML unescaped, and PolicyEndpoint::index() (src/Policy/PolicyEndpoint.php) returns the stored body verbatim.

Safety currently rests entirely on wp_kses_post being applied on every write path — which it is today (REST addVersion/updateVersion and the admin PolicyController) — but any future write path that forgets it becomes stored XSS served to every student in the booking/enrolment flow.

The server-rendered registration template already applies wp_kses_post at output (templates/frontend/register-page.php); the REST listing should match.

Fix

Run the body through wp_kses_post() in PolicyEndpoint::index() before returning it. Update the endpoint unit test.

## Finding (security review — Low, defense-in-depth) `assets/js/booking.js` and `assets/js/group-classes.js` inject the policy `body` from `GET /policies` into `innerHTML` unescaped, and `PolicyEndpoint::index()` (src/Policy/PolicyEndpoint.php) returns the stored body verbatim. Safety currently rests entirely on `wp_kses_post` being applied on every write path — which it is today (REST `addVersion`/`updateVersion` and the admin `PolicyController`) — but any future write path that forgets it becomes stored XSS served to every student in the booking/enrolment flow. The server-rendered registration template already applies `wp_kses_post` at output (templates/frontend/register-page.php); the REST listing should match. ## Fix Run the body through `wp_kses_post()` in `PolicyEndpoint::index()` before returning it. Update the endpoint unit test.

thatguygriff added the security label 2026-06-10 18:50:52 +00:00

thatguygriff referenced this issue from a commit

2026-06-10 19:36:30 +00:00

Security fixes: CSV injection, policy body output, invite hashing, slot datetimes

thatguygriff referenced this issue

2026-06-10 19:39:33 +00:00

Security fixes: CSV injection, policy body output, invite token hashing, slot datetime validation #43

thatguygriff closed this issue

2026-06-10 19:51:22 +00:00

Sign in to join this conversation.