hardening(forms): render input attributes safely

[somethingwithproof]

Adds small HTML input rendering helpers that escape attribute names and values, then migrates package import hidden fields and the aggregate graph rfilter textbox away from raw value interpolation.

This narrows two recurring reflected-XSS patterns: serialized hidden state in single-quoted attributes and request-derived filter text in text input values. Package import state now uses safer form helpers instead of hand-built hidden inputs.

Validation: local PHP syntax checks passed for the changed files. GitHub checks pass for PHP 8.1, 8.2, 8.3, 8.4, and the Pest coverage gate.

Part of #7371

[Copilot]

Pull request overview

This PR hardens HTML form rendering in Cacti by introducing centralized helpers for safely rendering <input> attributes and then adopting them in a couple of high-risk spots (package import hidden fields and aggregate graph filtering) to reduce reflected-XSS exposure.

Changes:

• Add html_attributes(), html_hidden_input(), and html_text_input() helpers in lib/html.php to consistently escape attribute values.
• Replace raw hidden-field serialization in package_import.php with a session-backed import_state token and render hidden inputs via the new helper.
• Migrate the Aggregate Graphs “rfilter” textbox to html_text_input() and add unit tests covering the new helpers.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
lib/html.php	Adds attribute/input rendering helpers that escape attribute values (and sanitize attribute names).
package_import.php	Switches import execution state from request-hidden serialized blobs to a session token, and uses helper-rendered hidden inputs.
aggregate_graphs.php	Uses the new helper to safely render the request-derived rfilter textbox value.
tests/Unit/HtmlEscapeTest.php	Adds unit tests for the new helpers’ escaping behavior.

[TheWitness]

CI is failing on this one.

[TheWitness]

@somethingwithproof, it looks like your commits are not running the pre-commit hooks. Failing from a PSR issue now.

[somethingwithproof]

Addressed in 8f519b2.

The failing CI check was PHP-CS-Fixer only: its required alignment for the package-import state token is now applied. No runtime behavior changed.

Validation: PHP lint and diff check passed; the PR CI rerun is the remaining confirmation.

[somethingwithproof]

The previously reported formatting check is now passing on the latest completed CI run; the remaining review gate is ready for re-check.

[somethingwithproof]

@copilot review

[somethingwithproof]

CI failure fixed. Green now.

[somethingwithproof]

Fixed, that was the php-cs-fixer PSR issue the pre-commit hook catches on the test file.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

package_import.php:140

• When import_state is present, the code overrides several import-affecting inputs from the stored state, but drp_action is still read from the request later (e.g. if (grv('drp_action') == 1)). That means a valid import_state token can still be replayed with a mismatched drp_action, undermining the “bind every import-affecting input” goal and potentially altering behavior.

At minimum, force drp_action to the expected action when consuming an import_state token (or ideally store/restore it from the state token as well).

	if (isrv('import_state')) {
		$import_state = package_import_take_state(grv('import_state'));

		if ($import_state === false) {
			raise_message('invalid_import_state', __('The selected package import state has expired or is invalid. Please review the package and try again.'), MESSAGE_LEVEL_ERROR);
			header('Location: package_import.php');

			exit;
		}

		$package_location = $import_state['package_location'];
		$profile_id       = $import_state['data_source_profile'];
		$remove_orphans   = $import_state['remove_orphans'];
		$replace_svalues  = $import_state['replace_svalues'];
	}