chore: complete M1.1 runtime QA and release packaging

2026-09-13 19:04:41 +03:30
commit f11e1d650d
66 changed files with 3094 additions and 0 deletions
@@ -0,0 +1,64 @@
+# XShop – Security
+
+## 1. Principles
+
+- Sanitize in, validate, escape out.
+- Nonce + capability for every state-changing request.
+- Use WP/WC APIs; no hand-rolled auth/crypto.
+
+## 2. Input
+
+- `sanitize_text_field`, `sanitize_textarea_field`, `sanitize_email`, `wc_clean`, `absint`, `esc_url_raw` per type.
+- Validate: enums via allow-list, URLs via `wp_http_validate_url` where remote, dates via `DateTimeImmutable`.
+- No `$_GET`/`$_POST` without sanitization. No `extract()`.
+
+## 3. Output
+
+- `esc_html`, `esc_attr`, `esc_url`, `esc_html__`, `wp_kses_post` (only for intentionally HTML fields with allow-list), `wp_kses` for narrow HTML.
+- No `echo $raw`.
+
+## 4. CSRF
+
+- Every POST/AJAX/REST mutation: `check_ajax_referer` / `wp_verify_nonce` / `X-WP-Nonce` header for REST.
+- REST: `permission_callback` checks nonce and capability.
+
+## 5. AuthZ
+
+- Admin screens: `current_user_can('manage_options')` or `manage_woocommerce` where appropriate (documented per screen).
+- Q&A: `edit_posts` for moderation; user can delete own question via `delete_post` cap check.
+- Banners: `manage_options`.
+
+## 6. XSS
+
+- No inline `onclick` with untrusted data. No `innerHTML` with unsanitized server data – DOM via `textContent` or sanitized fragment.
+- Stored XSS: banner CTA/link, Q&A body – sanitized on save, escaped on render.
+
+## 7. SQLi
+
+- No raw SQL unless via `$wpdb->prepare`. Prefer `WP_Query`/`WC` CRUD. No string-concatenated queries.
+
+## 8. Special Cases
+
+- **File uploads**: use `wp_handle_upload` + `wp_check_filetype`, no arbitrary file execution, no path traversal (`sanitize_file_name`, `realpath` check).
+- **Redirects**: `wp_safe_redirect` + `wp_validate_redirect` allow-list.
+- **Unserialize**: never `unserialize` user data; use JSON.
+- **Secrets**: no inline secrets; no committed `.env`.
+- **Remote import**: validate MIME, size cap, timeout, no SSRF (allow-list demo asset host if any).
+
+## 9. Headers (theme-level)
+
+- Theme does not override server headers; document recommended headers for host (CSP, etc.) in `docs/security.md`.
+
+## 10. Checklist per Feature
+
+- [ ] Inputs sanitized + validated
+- [ ] Nonce verified
+- [ ] Capability checked
+- [ ] Outputs escaped
+- [ ] No raw SQL
+- [ ] No unsafe redirect/unserialize/upload
+
+## 11. Review Process
+
+- PHPCS `WordPress.Security` + manual review before each release.
+- Security note in CHANGELOG.md.