Harden security

[M-arcus]

This pull request introduces several security and privacy improvements to the handling of CXml messages. The main focus is on protecting sensitive information (like shared secrets) in logs and error messages, enhancing authentication security, and improving XML parsing security.

Key security and privacy improvements:

Sensitive Data Redaction in Logs and Errors:

• Updated logging in Endpoint.php to redact shared secrets from CXml payloads before logging, preventing sensitive information from appearing in logs. This is achieved by introducing a new removeSharedSecret method and applying it to all relevant log statements. [1] [2] [3]
• Modified exception handling in CXmlInvalidException.php to redact shared secrets from XML included in error messages.

Authentication Security Enhancements:

• Replaced direct string comparison of shared secrets with hash_equals() in both SimpleSharedSecretAuthenticator.php and Registry.php for constant-time comparison, mitigating timing attacks. [1] [2]

XML Parsing Security:

• Updated XML loading in DtdValidator.php to disable network access (LIBXML_NONET), reducing the risk of XML External Entity (XXE) attacks.

[mathielen]

Awesome! 👏

[M-arcus]

I have fixed the code style issues reported by the static PHP validation.