security: review ContentService string replacement #39

New issue

Open

opened 2026-02-20 03:02:45 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 03:02:45 +00:00

Member

Issue

Services/ContentService.php (lines 218-222) uses unvalidated string replacement.

Current Code

$prompt = str_replace(
    ['{{DRAFT_CONTENT}}'],
    [$draft],  // $draft is unvalidated file content
    $refinementPrompt
);

Risk

If $draft contains special characters, could inject template syntax.

Acceptance Criteria

Add validation/escaping to $draft content
Document allowed content format
Add tests for injection attempts
Consider using template engine

References

Related to VAL-001 (template variable injection)
Discovered in security scan

## Issue `Services/ContentService.php` (lines 218-222) uses unvalidated string replacement. ## Current Code ```php $prompt = str_replace( ['{{DRAFT_CONTENT}}'], [$draft], // $draft is unvalidated file content $refinementPrompt ); ``` ## Risk If $draft contains special characters, could inject template syntax. ## Acceptance Criteria - [ ] Add validation/escaping to $draft content - [ ] Document allowed content format - [ ] Add tests for injection attempts - [ ] Consider using template engine ## References - Related to VAL-001 (template variable injection) - Discovered in security scan