Fortify Scan - Header Manupulation - portal/vendor/ezyang/htmlpurifier/plugins/phorum/settings/migrate-sigs.php

Hi,

We had a fortify scan on our code base to check for possible security vulnerabilities and the following has been reported from this library, request you to look into it.

Issue Description -
Including unvalidated data in an HTTP response header can enable cache-poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation or open redirect.

Recommendation Offered -
The solution to Header Manipulation is to ensure that input validation occurs in the correct places and checks for the correct properties. Since Header Manipulation vulnerabilities occur when an application includes malicious data in its output, one logical approach is to validate data immediately before it leaves the application.

Occurences -
1.portal/vendor/ezyang/htmlpurifier/plugins/phorum/settings/migrate-sigs.php, line 74
2.portal/vendor/ezyang/htmlpurifier/plugins/phorum/settings/migrate-sigs.php, line 16
3.portal/vendor/ezyang/htmlpurifier/plugins/phorum/settings/migrate-sigs.php, line 70

Start by reviewing portal/vendor/ezyang/htmlpurifier/plugins/phorum/settings/migrate-sigs.php at lines 16, 70, and 74, then inspect the Fortify report details for the affected response headers. Confirm which inputs reach those headers and define completion as removing the reported header-manipulation findings without changing the migration behavior.