Security Audit: depage-forms

Date: 2026-05-21 Scope: All non-vendor PHP source files

---

1. Server-Side Request Forgery (SSRF)

Severity: High Locations: HtmlForm.php:265, 269, 1098, 1118

The submitURL and url are derived from ‘$_SERVER['REQUEST_URI’] without any validation. If successURL is set to a user-controlled value, it could lead to SSRF attacks. The buildUrl() method constructs URLs using $this->url['host'] from a parse_url()` call on unvalidated input.

---

2. Open Redirect

Severity: Medium Location: HtmlForm.php:985

The redirect() method performs an unvalidated redirect:

header('Location: ' . $url);

An attacker controlling the URL could redirect users to malicious sites.

---

3. CRLF Injection

Severity: Medium Location: HtmlForm.php:985

The redirect() function does not sanitize the URL before passing it to header(). An attacker could inject newlines to modify HTTP headers (e.g., setting cookies).

---

4. Path Traversal / Local File Inclusion

Severity: High Location: HtmlForm.php:78-83

The autoloader constructs a file path from the class name with minimal sanitization:

$class = str_replace('\\', '/', str_replace(__NAMESPACE__ . '\\', '', $class));
$file = __DIR__ . '/' . $class . '.php';
if (file_exists($file)) {
    require_once($file);
}

Improper use could allow path traversal via .. in class names.

---

5. HTML Injection (XSS) / SSRF via DOMDocument

Severity: Medium Location: HtmlDom.php:88

The loadHTML() method takes raw HTML input and passes it to DOMDocument::loadHTML() without sanitization:

$success = @$tmpDOM->loadHTML(
    "<meta http-equiv=\"content-type\" content=\"text/html; charset=$encoding\">$html",
    $options
);

If user-controlled HTML flows through here (e.g., via the Richtext element), it enables SSRF (via img src or other URL-bearing tags) and XSS.

---

6. File Upload Vulnerabilities

Severity: Medium-High Location: Elements/File.php:148-155

The handleUploadedFiles() method uses move_uploaded_file() but has several weaknesses:

• Only performs client-side extension validation (no server-side MIME/content type validation)
• tempnam("", "depage-form-upload-") uses an empty directory, defaulting to a world-writable directory (/tmp on Linux)
• No validation of actual file content or magic bytes
• Filename from $_FILES is used directly without sanitization in the returned array

---

7. Session Fixation / Weak Session Handling

Severity: Low-Medium Location: HtmlForm.php:343-371

The session handling does not regenerate session IDs. The session cookie parameters are taken from session_get_cookie_params() which may not enforce samesite=strict.

---

8. CSP Header Bypass via dataAttr

Severity: Low Location: Element.php:325-335

The htmlDataAttributes() method could be a vector for CSP bypass if attacker-controlled data enters $this->dataAttr keys/values.

---

9. Unvalidated Redirect Chain

Severity: Medium Location: HtmlForm.php:781-827

The process() method uses $this->successURL (derived from ‘$_SERVER['REQUEST_URI’]) for redirects. If a developer sets successURL` to a user-controlled value, it enables open redirects.

---

10. Weak Attribute Sanitization in HtmlDom::cleanHTML()

Severity: Low-Medium Location: HtmlDom.php:124-220

The allowed tag list is hardcoded but overridable. The method strips disallowed tags but does not sanitize dangerous attributes like onclick, onerror, inline style with expression(), or javascript: URIs in allowed attributes like href.

---

11. Information Exposure in uploadprogress.php

Severity: Medium Location: uploadprogress.php

The uploadprogress.php file exposes APC upload progress data via JSON without any access control. It directly accesses ‘$_GET['APC_UPLOAD_PROGRESS’]` which interacts with APC's internal tracking.

---

12. No Auth Check on Session Cleanup

Severity: Low Location: HtmlForm.php:1033

The clearOldSessions() static method operates on $_SESSION without any authentication check.

---

Positives

• CSRF protection is implemented via formCsrfToken in sessions (HtmlForm.php:283-286, 700-701, 906-914)
• HTML escaping uses htmlspecialchars($options, ENT_QUOTES) consistently in htmlEscape() (Element.php:282-304)
• Element names are validated against invalid characters via regex (Element.php:237)
• The Richtext element uses HtmlDom::cleanHTML() to strip disallowed tags (Richtext.php:176)

Recommended Fixes

1. Validate all URLs against an allowlist or use filter_var($url, FILTER_VALIDATE_URL) before use in redirects or HTTP requests.
2. Add CRLF stripping to redirect() via filter_var($url, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES).
3. Add server-side MIME validation for file uploads using finfo_open() or getimagesize().
4. Sanitize href attributes in HtmlDom::cleanHTML() to reject javascript: URIs and event handler attributes.
5. Regenerate session IDs after authentication-sensitive actions.
6. Add access control to uploadprogress.php or remove it if unused.