upskill-event-manager/docs/SECURITY-REMEDIATION-PLAN.md

# HVAC Community Events Security Remediation Plan

## Executive Summary

This document outlines a comprehensive security remediation plan to address critical vulnerabilities discovered in the HVAC Community Events plugin's event creation form through automated security testing. The plan provides a systematic approach to eliminate all identified security issues while maintaining the enhanced UI/UX functionality.

## Vulnerability Assessment Results

### CRITICAL VULNERABILITIES IDENTIFIED:

```
┌─────────────────────────────────────────────────────────────────┐
│ SECURITY TEST RESULTS                                           │
├─────────────────────────────────────────────────────────────────┤
│ [CRITICAL] XSS Vulnerability in Rich Text Editor               │
│            - Script tags pass through unfiltered               │
│            - Malicious content stored in form data             │
│            - Risk: Session hijacking, data theft               │
├─────────────────────────────────────────────────────────────────┤
│ [HIGH]     File Upload Security Bypass                         │
│            - PHP files accepted without validation             │
│            - Risk: Remote code execution                       │
├─────────────────────────────────────────────────────────────────┤
│ [HIGH]     Missing CSRF Protection                             │
│            - No token validation visible                       │
│            - Risk: Cross-site request forgery                  │
├─────────────────────────────────────────────────────────────────┤
│ [MEDIUM]   Form Validation Failures                            │
│            - Required fields not enforced                      │
│            - Risk: Data integrity issues                       │
├─────────────────────────────────────────────────────────────────┤
│ [MEDIUM]   Security Control Gaps                               │
│            - No input length limits                            │
│            - Risk: DoS via large payloads                      │
└─────────────────────────────────────────────────────────────────┘
```

## Implementation Plan

### PHASE 1: IMMEDIATE CRITICAL FIXES (URGENT)

#### 1.1 XSS Vulnerability Remediation

**Target Files:**
- `assets/js/hvac-tec-tickets.js` (lines 68, 77)
- `includes/class-hvac-event-form-builder.php`

**Implementation:**

```javascript
// CURRENT VULNERABLE CODE (hvac-tec-tickets.js):
editor.innerHTML = hiddenTextarea.value;
textarea.value = editor.innerHTML;

// SECURE REPLACEMENT:
const cleanContent = DOMPurify.sanitize(hiddenTextarea.value, {
    ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'ul', 'ol', 'li', 'a'],
    ALLOWED_ATTR: ['href', 'title'],
    ALLOW_DATA_ATTR: false
});
editor.innerHTML = cleanContent;

// Server-side sanitization backup:
textarea.value = DOMPurify.sanitize(editor.innerHTML, {
    ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'ul', 'ol', 'li', 'a'],
    ALLOWED_ATTR: ['href', 'title']
});
```

**Server-side Implementation:**

```php
// Add to class-hvac-event-form-builder.php
private function sanitize_rich_text_content($content) {
    $allowed_html = array(
        'p' => array(),
        'br' => array(),
        'strong' => array(),
        'em' => array(),
        'ul' => array(),
        'ol' => array(),
        'li' => array(),
        'a' => array(
            'href' => array(),
            'title' => array()
        )
    );

    return wp_kses($content, $allowed_html);
}
```

#### 1.2 File Upload Security Implementation

**Target Files:**
- `includes/class-hvac-event-form-builder.php`

**Implementation:**

```php
private function validate_file_upload($file) {
    // MIME type whitelist
    $allowed_types = array(
        'image/jpeg',
        'image/png',
        'image/gif',
        'application/pdf'
    );

    // File extension whitelist
    $allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf');

    // Validate MIME type
    if (!in_array($file['type'], $allowed_types)) {
        return new WP_Error('invalid_file_type',
            __('File type not allowed. Only JPEG, PNG, GIF, and PDF files are permitted.', 'hvac-community-events'));
    }

    // Validate file extension
    $file_extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($file_extension, $allowed_extensions)) {
        return new WP_Error('invalid_file_extension',
            __('File extension not allowed.', 'hvac-community-events'));
    }

    // File size limit (5MB)
    if ($file['size'] > 5 * 1024 * 1024) {
        return new WP_Error('file_too_large',
            __('File size exceeds 5MB limit.', 'hvac-community-events'));
    }

    // Additional security checks
    if ($file['error'] !== UPLOAD_ERR_OK) {
        return new WP_Error('upload_error',
            __('File upload failed.', 'hvac-community-events'));
    }

    return true;
}

private function handle_secure_file_upload($file) {
    $validation_result = $this->validate_file_upload($file);

    if (is_wp_error($validation_result)) {
        return $validation_result;
    }

    // Move file to secure location outside web root
    $upload_dir = wp_upload_dir();
    $secure_dir = $upload_dir['basedir'] . '/hvac-events/';

    if (!file_exists($secure_dir)) {
        wp_mkdir_p($secure_dir);
        // Add .htaccess to prevent direct access
        file_put_contents($secure_dir . '.htaccess', 'deny from all');
    }

    $filename = sanitize_file_name($file['name']);
    $unique_filename = wp_unique_filename($secure_dir, $filename);
    $file_path = $secure_dir . $unique_filename;

    if (move_uploaded_file($file['tmp_name'], $file_path)) {
        return array(
            'filename' => $unique_filename,
            'path' => $file_path,
            'url' => $this->get_secure_file_url($unique_filename)
        );
    }

    return new WP_Error('upload_failed',
        __('Failed to save uploaded file.', 'hvac-community-events'));
}
```

#### 1.3 CSRF Protection Implementation

**Target Files:**
- All template files with forms
- `includes/class-hvac-tec-tickets.php` (AJAX handlers)
- `assets/js/hvac-tec-tickets.js`

**Template Implementation:**

```php
// Add to all form templates
<?php wp_nonce_field('hvac_event_create', 'hvac_event_nonce'); ?>
```

**AJAX Handler Protection:**

```php
// Update all AJAX handlers in class-hvac-tec-tickets.php
public function ajax_create_event_tickets(): void {
    // Security check
    if (!wp_verify_nonce($_POST['hvac_event_nonce'] ?? '', 'hvac_event_create')) {
        wp_send_json_error(array(
            'message' => __('Security check failed. Please refresh the page and try again.', 'hvac-community-events')
        ));
        return;
    }

    // Capability check
    if (!current_user_can('edit_posts')) {
        wp_send_json_error(array(
            'message' => __('You do not have permission to perform this action.', 'hvac-community-events')
        ));
        return;
    }

    // Continue with existing logic...
}
```

**JavaScript Updates:**

```javascript
// Update AJAX requests to include nonce
const formData = new FormData();
formData.append('action', 'hvac_create_event');
formData.append('hvac_event_nonce', document.querySelector('[name="hvac_event_nonce"]').value);
// Add other form data...

fetch(ajaxurl, {
    method: 'POST',
    body: formData
})
```

### PHASE 2: COMPREHENSIVE SECURITY HARDENING

#### 2.1 Input Validation and Sanitization

```php
private function validate_and_sanitize_input($data) {
    $sanitized = array();

    // Event title
    $sanitized['post_title'] = sanitize_text_field($data['post_title'] ?? '');
    if (strlen($sanitized['post_title']) < 3) {
        return new WP_Error('title_too_short',
            __('Event title must be at least 3 characters.', 'hvac-community-events'));
    }

    // Event description
    $sanitized['post_content'] = $this->sanitize_rich_text_content($data['post_content'] ?? '');

    // Date validation
    if (!empty($data['event_date'])) {
        $date = DateTime::createFromFormat('Y-m-d', $data['event_date']);
        if (!$date || $date->format('Y-m-d') !== $data['event_date']) {
            return new WP_Error('invalid_date',
                __('Invalid event date format.', 'hvac-community-events'));
        }
        $sanitized['event_date'] = $date->format('Y-m-d');
    }

    return $sanitized;
}
```

#### 2.2 Rate Limiting Implementation

```php
private function check_rate_limit($user_id = null) {
    $user_id = $user_id ?: get_current_user_id();
    $key = 'hvac_form_submit_' . $user_id;
    $attempts = get_transient($key) ?: 0;

    if ($attempts >= 10) { // 10 attempts per hour
        return new WP_Error('rate_limit_exceeded',
            __('Too many attempts. Please wait before trying again.', 'hvac-community-events'));
    }

    set_transient($key, $attempts + 1, HOUR_IN_SECONDS);
    return true;
}
```

#### 2.3 Enhanced Error Handling

```php
private function handle_secure_error($error, $context = '') {
    // Log error for debugging (without sensitive data)
    error_log(sprintf(
        '[HVAC Security] %s: %s (Context: %s)',
        current_time('mysql'),
        $error->get_error_message(),
        $context
    ));

    // Return generic error to user
    return new WP_Error('security_error',
        __('A security error occurred. Please try again or contact support.', 'hvac-community-events'));
}
```

### PHASE 3: TESTING & VALIDATION

#### 3.1 Security Test Suite Expansion

```javascript
// Enhanced XSS testing scenarios
const xssPayloads = [
    '<script>alert("XSS")</script>',
    '<img src="x" onerror="alert(1)">',
    '<svg onload="alert(1)">',
    'javascript:alert(1)',
    '<iframe src="javascript:alert(1)"></iframe>'
];

// File upload security tests
const maliciousFiles = [
    { name: 'test.php', type: 'text/php' },
    { name: 'test.exe', type: 'application/x-executable' },
    { name: 'test.jsp', type: 'text/jsp' },
    { name: 'test.asp', type: 'text/asp' }
];
```

#### 3.2 Automated Security Scanning

```bash
# Add to CI/CD pipeline
npm install --save-dev @security/code-scanner
npm run security:scan -- --path=assets/js/
npm run security:scan -- --path=includes/
```

### PHASE 4: LONG-TERM SECURITY INFRASTRUCTURE

#### 4.1 Content Security Policy Implementation

```php
// Add to main plugin file
public function add_security_headers() {
    if (is_admin() && strpos($_SERVER['REQUEST_URI'], 'hvac-events') !== false) {
        header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';");
        header("X-Frame-Options: SAMEORIGIN");
        header("X-Content-Type-Options: nosniff");
        header("Referrer-Policy: strict-origin-when-cross-origin");
    }
}
add_action('send_headers', array($this, 'add_security_headers'));
```

#### 4.2 Security Monitoring

```php
private function log_security_event($event_type, $details) {
    $log_entry = array(
        'timestamp' => current_time('mysql'),
        'event_type' => $event_type,
        'user_id' => get_current_user_id(),
        'ip_address' => $this->get_client_ip(),
        'details' => $details
    );

    // Store in dedicated security log table
    global $wpdb;
    $wpdb->insert(
        $wpdb->prefix . 'hvac_security_log',
        $log_entry
    );
}
```

## Implementation Workflow

```
PHASE 1: CRITICAL FIXES
│
├── Step 1: XSS Vulnerability Fix
│   ├── Update JavaScript sanitization
│   ├── Add server-side validation
│   └── Test XSS prevention
│
├── Step 2: File Upload Security
│   ├── Implement MIME validation
│   ├── Add file size limits
│   └── Test malicious file rejection
│
├── Step 3: CSRF Protection
│   ├── Add nonces to forms
│   ├── Update AJAX handlers
│   └── Test token validation
│
└── Step 4: Emergency Deployment
    ├── Deploy to staging
    ├── Run security test suite
    └── Production deployment

PHASE 2: SECURITY HARDENING
│
├── Input validation enhancement
├── Rate limiting implementation
├── Error handling improvement
└── Security monitoring setup

PHASE 3: TESTING VALIDATION
│
├── Automated security testing
├── Penetration test validation
├── Security regression tests
└── Documentation updates

PHASE 4: INFRASTRUCTURE
│
├── Content Security Policy
├── Security headers
├── Audit procedures
└── Vulnerability management
```

## Success Metrics

### Security Validation Criteria:

- [ ] Zero XSS vulnerabilities detected in automated scans
- [ ] All malicious file upload attempts blocked (100% success rate)
- [ ] CSRF tokens validated on all form submissions
- [ ] Input validation prevents injection attacks
- [ ] Rate limiting blocks excessive requests
- [ ] Security headers properly configured
- [ ] Error handling prevents information disclosure
- [ ] Comprehensive test suite achieves 95%+ coverage

### Monitoring and Maintenance:

- [ ] Security event logging operational
- [ ] Weekly automated security scans scheduled
- [ ] Quarterly penetration testing planned
- [ ] Security patch deployment process established
- [ ] Incident response procedures documented

## Branch Strategy

```bash
# Create security fix branch
git checkout -b security/critical-vulnerabilities-fix

# Development workflow
git add includes/class-hvac-event-form-builder.php
git add assets/js/hvac-tec-tickets.js
git add includes/class-hvac-tec-tickets.php
git commit -m "fix: implement critical security vulnerability fixes

- Add XSS sanitization to rich text editor
- Implement file upload validation and security controls
- Add CSRF token protection to all forms
- Enhance input validation and rate limiting

Fixes: XSS, File Upload Bypass, CSRF, Input Validation"

# Deploy to staging for validation
scripts/deploy.sh staging

# After security validation passes
git checkout main
git merge security/critical-vulnerabilities-fix
scripts/deploy.sh production
```

## Dependencies and Prerequisites

### Required Libraries:
- DOMPurify (for client-side sanitization)
- WordPress wp_kses (server-side sanitization)
- WordPress nonce system (CSRF protection)

### Testing Requirements:
- Playwright test framework (already configured)
- Security scanner integration
- Staging environment access

### Documentation Updates:
- Security procedures documentation
- Developer security guidelines
- User security awareness materials

---

**Document Status:** Planning Complete
**Next Action:** Begin Phase 1 implementation
**Priority:** URGENT - Critical security vulnerabilities require immediate attention
**Estimated Total Implementation:** 4-week phased approach