Add input sanitization on OG values (defense-in-depth) #79

New Issue

2026-06-23T13:32:58Z

jmiller commented

2026-06-23 13:32:58 +00:00

Summary

While OG values are escaped on output via Joomla's setMetaData() API, there is no explicit sanitization on input when saving to the database. Adding input sanitization provides defense-in-depth against stored XSS.

Current State

Output escaping: YES (via Joomla API) — safe against reflected XSS
Input sanitization: NO — raw user input stored in #__mokoog_tags
TagTable::check() validates structure (length, format) but doesn't strip HTML/scripts

Recommendation

Add InputFilter::clean() or strip_tags() to text fields (og_title, og_description, seo_title, meta_description) in TagTable::check() or MokoOGContent::onContentAfterSave().

Impact

Low risk currently (output is escaped), but defense-in-depth is best practice for extensions that store user-provided content.

## Summary While OG values are escaped on output via Joomla's `setMetaData()` API, there is no explicit sanitization on input when saving to the database. Adding input sanitization provides defense-in-depth against stored XSS. ## Current State - Output escaping: YES (via Joomla API) — safe against reflected XSS - Input sanitization: NO — raw user input stored in `#__mokoog_tags` - TagTable::check() validates structure (length, format) but doesn't strip HTML/scripts ## Recommendation Add `InputFilter::clean()` or `strip_tags()` to text fields (og_title, og_description, seo_title, meta_description) in TagTable::check() or MokoOGContent::onContentAfterSave(). ## Impact Low risk currently (output is escaped), but defense-in-depth is best practice for extensions that store user-provided content.

jmiller added this to the Code Quality & Testing milestone 2026-06-23 13:32:58 +00:00

jmiller added the security label 2026-06-23 13:32:58 +00:00

jmiller commented

2026-06-23 13:33:06 +00:00

Branch created: feature/79-add-input-sanitization-on-og-values-defe

git fetch origin
git checkout feature/79-add-input-sanitization-on-og-values-defe

Branch created: [`feature/79-add-input-sanitization-on-og-values-defe`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteOpenGraph/src/branch/feature/79-add-input-sanitization-on-og-values-defe) ```bash git fetch origin git checkout feature/79-add-input-sanitization-on-og-values-defe ```

jmiller referenced this issue from a commit

2026-06-23 16:33:11 +00:00

fix: code quality improvements (#76, #77, #78, #79)

jmiller closed this issue

2026-06-23 16:39:28 +00:00

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteOpenGraph#79