Drupal Security

<?php
// Contexte 1 — texte pur dans un render array
$build['titre'] = ['#plain_text' => $user_input];

// Contexte 2 — HTML partiel (whitelist de balises)
$build['corps'] = ['#markup' => Markup::create(Xss::filter($html, ['b', 'i', 'em', 'strong', 'a']))];

// Contexte 3 — attribut HTML (href, class, data-*)
$attr = Html::escape($user_input);

// Contexte 4 — format de texte Drupal (Basic HTML, Full HTML)
$build['body'] = ['#markup' => check_markup($text, 'basic_html')];

// Contexte 5 — callback #pre_render (TrustedCallbackInterface obligatoire)
class MonCallback implements TrustedCallbackInterface {
  public static function trustedCallbacks(): array { return ['build']; }
  public static function build(array $element): array { return $element; }
}

// En Twig — auto-escape par défaut, jamais |raw sur input utilisateur
// {{ node.field_body.value }}      ✅ auto-escaped
// {{ node.field_body.value|raw }}  ❌ XSS si contenu utilisateur

<?php
// mon_module.module (ou classe #[Hook] D11)
function mon_module_entity_access(
  EntityInterface $entity,
  string $operation,
  AccountInterface $account
): AccessResultInterface {
  if (!$entity instanceof NodeInterface) return AccessResult::neutral();

  // Accès multi-organisation — chaque user ne voit que ses nodes
  if ($operation === 'view' && $entity->bundle() === 'rapport') {
    $user_org  = $account->get('field_organisation')->target_id ?? 0;
    $node_org  = $entity->get('field_organisation')->target_id ?? 0;
    return AccessResult::forbiddenIf($user_org !== $node_org)
      ->addCacheContexts(['user'])
      ->addCacheTags(['node:' . $entity->id()]);
  }
  return AccessResult::neutral();
}

#!/bin/bash
# .gitlab-ci.yml — job security-audit
FAIL=0

echo "=== SA actives ===" && drush pm:security || FAIL=1
echo "=== CVEs PHP ===" && composer audit --no-dev || FAIL=1

echo "=== Headers HTTP ===" && {
  HEADERS=$(curl -si https://$SITE_URL | grep -i -E 'X-Frame-Options|X-Content-Type|Strict-Transport|Content-Security')
  echo "$HEADERS"
  echo "$HEADERS" | grep -qi 'X-Frame-Options' || { echo "MISSING X-Frame-Options"; FAIL=1; }
  echo "$HEADERS" | grep -qi 'Strict-Transport' || { echo "MISSING HSTS"; FAIL=1; }
}

echo "=== Fichiers sensibles ===" && {
  curl -si https://$SITE_URL/.env | grep -q "200" && { echo "EXPOSED .env"; FAIL=1; }
  curl -si https://$SITE_URL/sites/default/settings.php | grep -q "200" && { echo "EXPOSED settings.php"; FAIL=1; }
}

exit $FAIL