Fortify Scan - Log Forging - portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Config.php

Hi,

We had a fortify scan on our code base to check for possible security vulnerabilities and the following has been reported from this library, request you to look into it.

Issue Description -
Writing unvalidated user input to log files can allow an attacker to forge log entries or inject malicious content into the logs.

Recommendation Offered -
Prevent log forging attacks with indirection: create a set of legitimate log entries that correspond to different events that must be logged and only log entries from this set. To capture dynamic content, such as users logging out of the system, always use server-controlled values rather than user-supplied data. This ensures that the input provided by the user is never used directly in a log entry.

Occurences -

1.portal/vendor/ezyang/htmlpurifier/plugins/phorum/settings/save.php, line 11
2.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Config.php line 901
3.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php, line 302
4.portal/vendor/ezyang/htmlpurifier/maintenance/flush-definition-cache.php, line 28
5.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/
Serializer.php, line 295
6.portal/vendor/ezyang/htmlpurifier/maintenance/flush-definition-cache.php, line 28
7.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/
Serializer.php, line 222
8.portal/vendor/ezyang/htmlpurifier/maintenance/flush-definition-cache.php, line 243
8.portal/vendor/ezyang/htmlpurifier/maintenance/flush-definition-cache.php, line 274

Review the reported locations in library/HTMLPurifier/Config.php, library/HTMLPurifier/DefinitionCache/Serializer.php, plugins/phorum/settings/save.php, and the maintenance scripts. Start by tracing the log writes and their inputs; done means the reported log-forging findings are addressed and the Fortify scan no longer flags them.