Fortify Scan - Path Manipulation - portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/StringHashParser.php

Hi,

We had a fortify scan on our code base to check for possible security vulnerabilities and the following has been reported from this library, request you to look into it.

Issue Description -
Allowing user input to control paths used in file system operations could enable an attacker to access or
modify otherwise protected system resources.

Recommendation Offered -
The best way to prevent path manipulation is with a level of indirection: create a list of legitimate resource names that a user is allowed to specify, and only allow the user to select from the list. With this approach the input provided by the user is never used directly to specify the resource name.

Occurrences -
1.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/StringHashParser.php, line 46
2.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 25
3.portal/vendor/ezyang/htmlpurifier/maintenance/flush-definition-cache.php, line 28
4.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 17
5.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php, line 220
6.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/
Serializer.php, line 241
7.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/
Serializer.php, line 113
8.portal/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php, line 284
9.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 84
10.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 81
11.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 47
12.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 26
13.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 66
14.portal/vendor/ezyang/htmlpurifier/maintenance/rename-config.php, line 25

Start by reviewing the reported lines in library/HTMLPurifier/StringHashParser.php, library/HTMLPurifier/DefinitionCache/Serializer.php, and the maintenance scripts, then trace whether their path inputs can be user-controlled. Compare each occurrence with the scan description and recommendation. Done means every listed occurrence is safely addressed or its non-user-controlled status is documented and verified.