Security Architecture

Security is not an afterthought in Encrypt CMS; it is built into every layer of the core runtime kernel.

---

1. Zero Raw SQL: Strict PDO Prepared Statements

All database interactions throughout core controllers and models utilize parameterized PDO statements:

// Core standard: 100% Parameterized queries
$user = Database::query(
    'SELECT * FROM users WHERE email = :email AND status = :status LIMIT 1',
    ['email' => $email, 'status' => 'active']
);

• PDO::ATTR_EMULATE_PREPARES is explicitly set to false. Queries and data are sent to the database engine in separate protocol packets, mathematically preventing SQL injection attacks.
• String concatenation of user input into SQL queries is strictly prohibited across the codebase.

---

2. Output Escaping & XSS Defense

Cross-Site Scripting (XSS) is mitigated by enforcing HTML entity encoding on all user-supplied outputs:

• The global template escaping helper $e($string) wraps htmlspecialchars($string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8').
• Rich text content from the WYSIWYG editor is sanitized against an approved HTML element whitelist before storage and rendering.

---

3. Cryptographic CSRF Protection

Every state-changing HTTP request (POST, PUT, DELETE) requires a valid CSRF token:

• Tokens are generated using cryptographically secure random bytes (random_bytes(32)).
• Bound to the active user session.
• Validated via hash_equals() to prevent timing attacks.

---

4. Brute-Force Rate Limiting

The authentication subsystem integrates App\Core\RateLimiter:

• Tracks failed login attempts by composite keys (IP + Username).
• Triggers exponential backoff after 5 consecutive failures.
• Protects administrative login, password reset requests, and sensitive API endpoints.

---

5. Archive Extraction & Zip Slip Defense

When updating the core, themes, or plugins, ExtensionUpdateService and CoreUpdateService enforce strict extraction boundaries:

• Pre-Extraction SHA-256 Check: Downloaded packages are hashed and compared to authoritative checksums before extraction.
• Traversal Prevention: Archive member paths are validated. Paths containing .., leading slashes, Windows absolute drives (C:\), or root .htaccess modifications abort immediately.
• Zip Bomb Bounds: Compressed archives are capped at 50 MB, with expansion limited to 200 MB, 5,000 files, and a max 20:1 compression ratio.
• Atomic Rollback: A complete backup is created before file replacement. If extraction fails, the system automatically restores the previous working state.