magdev 89afa00678 security: OWASP audit and hardening (v1.0.8) ...

- Archive XSS: wrap get_the_archive_title/description with wp_kses_post()
  in ContextBuilder to sanitize Editor-editable term content rendered via |raw
- Comment fields: esc_html() on comment_author, esc_url() on comment_author_url
  at data source; template updated to output pre-escaped URL via |raw
- dark-mode.js: whitelist localStorage value against ['dark','light'] to
  prevent attribute injection from third-party script tampering
- TwigService: add is_safe=>html to esc_html/esc_attr/esc_url Twig functions
  to prevent double-encoding if autoescape is ever enabled
- Add .markdownlint.json (disable MD024 duplicate headings, MD013 line length)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-02-19 13:23:33 +01:00

..

ContextBuilder.php

security: OWASP audit and hardening (v1.0.8)

2026-02-19 13:23:33 +01:00

NavWalker.php

v0.1.1 - Bootstrap frontend rendering via Twig templates

2026-02-08 15:11:00 +01:00

TemplateController.php

feat: add wp_bootstrap_should_render_template filter for plugin decoupling (v1.0.4)

2026-02-11 11:48:08 +01:00