From 126a49185229f248eae8c485b3e16e029ebcb353 Mon Sep 17 00:00:00 2001
From: polo <ordipolo@gmx.fr>
Date: Fri, 23 Oct 2026 23:29:59 +0200
Subject: =?UTF-8?q?audit=20claude=20code=201,=20validation=20formulaire=20?=
 =?UTF-8?q?toujours=20ok,=20=C3=A9chappement=20dans=20URL,=20quelques=20ht?=
 =?UTF-8?q?mlspecialchars=20manquants,=20fonction=20Security::validateURL?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/View/HeaderBuilder.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/View/HeaderBuilder.php')

diff --git a/src/View/HeaderBuilder.php b/src/View/HeaderBuilder.php
index 14f5ffa..307c0bb 100644
--- a/src/View/HeaderBuilder.php
+++ b/src/View/HeaderBuilder.php
@@ -85,7 +85,7 @@ class HeaderBuilder extends AbstractBuilder
                 // boucle sur la liste complète de réseaux sociaux
                 foreach(NodeData::$social_networks as $network){
                     $checked = (isset($social_show[$network]) && $social_show[$network]) ? 'checked' : '';
-                    $href = (isset($social[$network]) && $social[$network] !== '') ? 'href="' . $social[$network] . '"' : '';
+                    $href = (isset($social[$network]) && $social[$network] !== '') ? 'href="' . htmlspecialchars($social[$network]) . '"' : '';
 
                     $social_networks .= '<div id="header_' . $network . '">
                         <input type="checkbox" onclick="checkSocialNetwork(\'header_' . $network . '\')" ' . $checked . '>
@@ -112,7 +112,7 @@ class HeaderBuilder extends AbstractBuilder
                     // boucle sur les réseaux sociaux "activés"
                     foreach(array_keys($social_show) as $network){
                         if($social_show[$network]){
-                            $href = (isset($social[$network]) && $social[$network] !== '') ? 'href="' . $social[$network] . '"' : '';
+                            $href = (isset($social[$network]) && $social[$network] !== '') ? 'href="' . htmlspecialchars($social[$network]) . '"' : '';
                             $social_networks .= '<div id="header_' . $network . '">
                                     <a ' . $href . ' target="_blank" rel="noopener noreferrer">'
                                         . $this->insertSVG(self::ICON_PATH . $network . '.svg', ['id' => 'header_' . $network . '_content','class' => 'svg_fill_red'])
-- 
cgit v1.2.3