mataba/shop/docs/SECURITY.md

XShop – Security

1. Principles

• Sanitize in, validate, escape out.
• Nonce + capability for every state-changing request.
• Use WP/WC APIs; no hand-rolled auth/crypto.

2. Input

• sanitize_text_field, sanitize_textarea_field, sanitize_email, wc_clean, absint, esc_url_raw per type.
• Validate: enums via allow-list, URLs via wp_http_validate_url where remote, dates via DateTimeImmutable.
• No $_GET/$_POST without sanitization. No extract().

3. Output

• esc_html, esc_attr, esc_url, esc_html__, wp_kses_post (only for intentionally HTML fields with allow-list), wp_kses for narrow HTML.
• No echo $raw.

4. CSRF

• Every POST/AJAX/REST mutation: check_ajax_referer / wp_verify_nonce / X-WP-Nonce header for REST.
• REST: permission_callback checks nonce and capability.

5. AuthZ

• Admin screens: current_user_can('manage_options') or manage_woocommerce where appropriate (documented per screen).
• Q&A: edit_posts for moderation; user can delete own question via delete_post cap check.
• Banners: manage_options.

6. XSS

• No inline onclick with untrusted data. No innerHTML with unsanitized server data – DOM via textContent or sanitized fragment.
• Stored XSS: banner CTA/link, Q&A body – sanitized on save, escaped on render.

7. SQLi

• No raw SQL unless via $wpdb->prepare. Prefer WP_Query/WC CRUD. No string-concatenated queries.

8. Special Cases

• File uploads: use wp_handle_upload + wp_check_filetype, no arbitrary file execution, no path traversal (sanitize_file_name, realpath check).
• Redirects: wp_safe_redirect + wp_validate_redirect allow-list.
• Unserialize: never unserialize user data; use JSON.
• Secrets: no inline secrets; no committed .env.
• Remote import: validate MIME, size cap, timeout, no SSRF (allow-list demo asset host if any).

9. Headers (theme-level)

• Theme does not override server headers; document recommended headers for host (CSP, etc.) in docs/security.md.

10. Checklist per Feature

• Inputs sanitized + validated
• Nonce verified
• Capability checked
• Outputs escaped
• No raw SQL
• No unsafe redirect/unserialize/upload

11. Review Process

• PHPCS WordPress.Security + manual review before each release.
• Security note in CHANGELOG.md.