From 2294c8eda709f0eef10b6c459ab7bbfb8df401d5 Mon Sep 17 00:00:00 2001 From: Steve Hanlon Date: Wed, 18 Feb 2026 10:32:16 +0000 Subject: [PATCH] Security hardening and accessibility improvements (v1.1.0) Address findings from security audit: wrap inline JSON.parse in try/catch to prevent consent flow failure on corrupted cookies, allowlist admin tab parameter, clamp consent_expiry server-side, escape all server values in admin JS table builder, fix focus trap listener cleanup, add aria-labelledby and banner focus for screen readers, skip frontend loading during AJAX. Co-Authored-By: Claude Opus 4.6 --- SECURITY_TASKS.md | 106 +++++++++++++++++++++++++++++++++ admin/js/admin.js | 25 ++++---- att-consent.php | 4 +- includes/class-admin.php | 7 ++- includes/class-att-consent.php | 2 +- includes/class-frontend.php | 12 ++-- public/js/banner.js | 14 ++++- 7 files changed, 146 insertions(+), 24 deletions(-) create mode 100644 SECURITY_TASKS.md diff --git a/SECURITY_TASKS.md b/SECURITY_TASKS.md new file mode 100644 index 0000000..4d16b62 --- /dev/null +++ b/SECURITY_TASKS.md @@ -0,0 +1,106 @@ +# ATT Consent — Security & Standards Audit + +Audit date: 2026-02-18 + +## Summary + +| Severity | Count | Status | +|----------|-------|--------| +| Critical | 0 | — | +| High | 2 | Documented (by-design / future consideration) | +| Medium | 4 | Fix in progress | +| Low | 7 | Fix in progress (priority items) | + +--- + +## High Severity + +### H1. Admin Script Snippets Rendered Raw to Frontend + +**File:** `includes/class-scripts-manager.php:106`, `includes/class-frontend.php:178,185` +**Status:** By design — no action required +**Detail:** The `snippet` field is stored raw and rendered to all visitors. This is the standard WordPress pattern for code-injection features (Theme Editor, HFCM). Protected by `manage_options` capability + nonce verification on save. + +### H2. Inline Scripts Incompatible with CSP + +**File:** `includes/class-frontend.php:68-127` +**Status:** Future consideration +**Detail:** The consent defaults and tracking scripts are output as raw inline `