Security
The line between what the framework protects against and what the application is responsible for is clearly drawn. If you find a security vulnerability, do not open a public issue; report it to [email protected] (with [SECURITY] in the subject).
What the Framework Provides
| Item | Description |
|---|---|
| SQL injection | All DAO queries use PDO prepared statements |
| Path traversal | Router include paths cannot escape public/ |
| Session integrity | AES-256-CBC + HMAC-SHA256, expiration verified server-side |
| Session cookies | HttpOnly·SameSite enabled by default; Secure automatic |
| Column encryption | @encrypt — synthetic IV (exact-match searchable), HMAC verification, HKDF key derivation |
| Forced logout | $SESSION_NOT_BEFOREinvalidates all sessions (stateless) |
Application Responsibilities
These features are intentionally not provided by the framework. Do not assume Flexagon handles them automatically.
// CSRF — no token mechanism is provided. Validate state-changing requests yourself.
// Output escaping — templates do not provide automatic escaping.
echo htmlspecialchars($user->getName(), ENT_QUOTES, 'UTF-8');
// Mass assignment — passing $_POST directly may overwrite fields such as id and role.
$user->setByArray(array_intersect_key($_POST, array_flip(['name', 'email'])));
// Serialization — getArray()/getJson() include all getters by default.
/** @exclude_from_get_array */
public function getPasswordHash(): string { ... }
The application is also responsible for validating redirect targets, preventing SSRF, sanitizing HTML, and setting appropriate security headers.
The
HtmlUtil::stripSpecificTag()family is regex-based and is not an XSS filter. These methods are convenience helpers for cleaning up tags only.