Fix security vulnerabilities: HTTP Host Injection, XSS, path traversal

[Copilot]

Security review identified 5 vulnerabilities and 1 bug. All remediated with input validation and output escaping.

Vulnerabilities Fixed

Critical: HTTP Host Header Injection

• $_SERVER['HTTP_HOST'] used without validation in index.php
• Added regex validation to prevent cache poisoning and phishing attacks

if (!preg_match('/^[a-zA-Z0-9.\-:]+$/', $domain)) {
    http_response_code(400);
    die("Invalid host header");
}

High: Cross-Site Scripting (4 instances)

• Alt attribute in preformatted blocks unescaped (lib-htmgem.inc.php:350)
• CSS href attributes unescaped (lib-html.inc.php:20)
• Menu links and labels unescaped (lib-html.inc.php:55-57)
• Applied htmlspecialchars() with ENT_QUOTES flag to all output

High: Path Traversal

• CSS style parameter constructed paths without validation
• Added whitelist: preg_match('/^[a-zA-Z0-9_\-]+$/', $style)

Bug Fix

TypeError in title processing

• spacesCompress($linkText) called with undefined variable
• Corrected to spacesCompress($title) in header cases

Testing

Added 6 security tests covering XSS and path traversal scenarios. All 21 tests pass (15 existing + 6 new).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh issue list --limit 20 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Code review as usual
Find security breaches
Look at the tickets and propose PR

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR hardens HtmGem against several web security issues by validating request-derived inputs (host/style) and escaping user-controlled output in generated HTML, and adds regression tests plus a written security review summary.

Changes:

• Added HTTP_HOST validation in index.php to mitigate Host Header Injection.
• Escaped multiple HTML outputs (code block alt text, CSS hrefs, menu links/labels) to address XSS vectors.
• Added a new PHPUnit security test suite and a SECURITY_REVIEW.md summary.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
index.php	Adds host header validation and style parameter whitelisting for CSS selection.
lib-html.inc.php	Escapes CSS hrefs and menu link/label output to prevent HTML/attribute injection.
lib-htmgem.inc.php	Escapes code-block alt text and fixes a header-title TypeError.
tests/securityTest.php	Adds regression tests for escaping and path traversal behavior.
SECURITY_REVIEW.md	Documents identified issues, fixes, and test results.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Sbgodin]

Good to go