Security verdict

21 checked, 2 not met, 22 declared, 0 not checked — 45 controls in the baseline.

Each control below is defined on the security baseline, which also says what each of the four states means. declared is not a pass.

Control	What it checks	State, scope and what is left
KYV-1	A secret an untrusted caller presents is compared in constant time and refused when it is unset — and where this extension mints it rather than taking core's or a merchant's, it carries at least 128 bits from a cryptographic random source.	declared — 0 bearer-secret surfaces over 0 mint, compare and refuse sites (0 × mint, 0 × constant-time compare, 0 × compare, 0 × refusal); 1 further entry says what the derivation reached that is not a secret
1.2.1	Store data meets markup safely where the danger is decidable — an unquoted attribute, a URL the template composed itself, a style, hand-built XML — and every store-derived subtree a template of this extension renders is written down beside the code. Beyond those two, nothing is claimed, and the page says so.	declared — machine-pass on the sinks: 0 sink sites asserted here, 0 not admitted; attested over the inventory: 6 store-derived subtrees over 3 templates; unverified beyond it: everything else: module_product_configurator_status — the module_product_configurator setting. Rendered by admin/view/template/module/product_configurator.twig. language_readout — core's language rows, reduced to the sentence saying which of them this screen resolved against. Rendered by admin/view/template/module/product_configurator.twig. version_warning — the store's own OpenCart version, compared against this extension's compatibility floor. Rendered by admin/view/template/module/product_configurator.twig. rules — the rules stored for one product — this extension's own product_configurator_rule and product_configurator_condition rows, carrying core's option and option-value ids. It is interpolated into a <script> element in that template rather than into markup, and it is encoded with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT. Rendered by admin/view/template/module/product_configurator_tab.twig, catalog/view/template/product/configurator.twig. swatches — the option values the storefront draws as swatches: core's product-option rows, with the image path and name core stored for each value. It is interpolated into a <script> element in that template rather than into markup, and it is encoded with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT. Rendered by catalog/view/template/product/configurator.twig. edit — the cart line this visit is reopening, resolved against the shopper's own session cart: the answers it holds and the quantity. It is interpolated into a <script> element in that template rather than into markup, and it is encoded with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT. Rendered by catalog/view/template/product/configurator.twig. Unverified beyond it: the other 161 of 173 template expressions in 8 templates, and any $data subtree nobody enumerated. The inventory is an inventory and not a bound: completeness over the whole expression surface is unverifiable, so this residual is permanent, and it is published rather than left to be inferred from what is missing.
1.2.2	A URL a template builds for itself, rather than taking one whole from the link helper, has every value in it URL-encoded — so nothing a store holds can add a parameter of its own or change where the link goes.	declared — 12 url attributes carrying a template expression, of 12 sink sites asserted: Every url attribute in this extension's templates takes its value whole from the link helper.
1.2.3	No template expression is interpolated into a <script> element, so store data cannot end a string literal and start running.	not met — 8 .twig files: extensions/product_configurator/src/admin/view/template/customer/personal_data.twig:154 — {{ erase }} is interpolated inside a <script> element extensions/product_configurator/src/admin/view/template/customer/purge.twig:71 — {{ remove }} is interpolated inside a <script> element extensions/product_configurator/src/admin/view/template/module/product_configurator_tab.twig:37 — {{ rules|raw }} is interpolated inside a <script> element extensions/product_configurator/src/admin/view/template/module/product_configurator_tab.twig:38 — {{ text|raw }} is interpolated inside a <script> element extensions/product_configurator/src/admin/view/template/module/product_configurator_tab.twig:159 — {{ field }} is interpolated inside a <script> element extensions/product_configurator/src/admin/view/template/module/product_configurator_tab.twig:250 — {{ field }} is interpolated inside a <script> element extensions/product_configurator/src/admin/view/template/module/product_configurator_tab.twig:326 — {{ copy|raw }} is interpolated inside a <script> element extensions/product_configurator/src/catalog/view/template/product/configurator.twig:65 — {{ rules }} is interpolated inside a <script> element extensions/product_configurator/src/catalog/view/template/product/configurator.twig:66 — {{ swatches }} is interpolated inside a <script> element extensions/product_configurator/src/catalog/view/template/product/configurator.twig:67 — {{ edit }} is interpolated inside a <script> element
1.2.4	Every way this extension builds a database statement is written down beside the code, so how a value reaches a query is a published answer rather than something to go looking for.	declared — 4 ways of building a statement, over 29 statements run and 3 values escaped: escaped string literal — a string goes through $this->db->escape() and is interpolated between single quotes: a rule's action and target type (admin/model/module/product_configurator.php), and the shopper's own session id when a reopened cart line is weighed (catalog/controller/event/configurator.php) interpolated identifier — a table name built from DB_PREFIX and a suffix constant of this extension's, interpolated between backticks, including in the SHOW TABLES and SHOW COLUMNS the installer asks before it alters anything; no identifier is ever built from request input interpolated integer — an (int) cast interpolated between single quotes — product_id, ruleset_id, rule_id, and core's option and option-value ids schema statement from a builder — the CREATE TABLE, ADD COLUMN and ADD KEY statements the installer runs are built whole by system/library/Schema out of its own constants and the store's DB_PREFIX, and handed to $this->db->query() one at a time 4 of the 29 statements are handed over already built, so what a rule reading the call site alone can see stops there; which mechanism built them is what the lines above say.
1.2.5	Nothing runs a command through the shell — no backtick, no exec() — so no value a store holds can become part of one.	checked — 44 .php files
1.3.1	No screen binds a rich-text editor whose HTML this extension would then render back out, because nothing here sanitises HTML and no sanitiser ships with it.	checked — 8 .twig files
1.3.2	Nothing runs code it assembled while running — no eval(), and no include of a path a variable decided.	checked — 44 .php files
1.5.1	Every XML parser is left at the restrictive default: nothing turns on external entity resolution, which is what would turn reading a spreadsheet into reading your server's files.	checked — 44 .php files
3.2.1	Every route declares the response type it sets, as the code sets it, so nothing is left for a browser to re-interpret as something it is not.	declared — 6 of 12 routes set a Content-Type of their own: 2 × Content-Type: application/json, with no charset 1 × application/json, with no charset (customer/personal_data.php:230) 1 × application/json, with no charset (customer/personal_data.php:272), sent as an attachment named for the person and the day (customer/personal_data.php:299) 1 × application/json, with no charset (customer/personal_data.php:359) 1 × application/json, with no charset (customer/purge.php:168) 3 × none set, and no output written 1 × none set; the page goes out under whatever the front controller defaults to 2 × none — nothing sets a Content-Type, so the store's default stands
3.2.2	Every place a script hands a value to the page as markup rather than as text is written down beside the code, with what it puts there.	declared — 7 call sites in 3 templates, each declared with what it writes there: 2 × .append( 2 × .html( 3 × .prepend(
3.3.1	A cookie this extension sets carries the Secure attribute at the call that sets it, so a browser cannot send it back over plain HTTP.	checked — 44 .php files
3.4.2	A cross-origin header is a fixed value this code chose — never a wildcard, and never the origin the caller asked for.	checked — 44 .php files
3.5.1	Every route that changes something says what stands between it and a request another website caused a visitor's browser to make.	declared — 5 routes of 12 reaches a model write; the 5 admin ones among them stand behind the user_token core checks before dispatch, and 11 admin routes are gated that way in all: No storefront route of this extension reaches a model write.
3.5.2	No route grants a cross-origin caller anything, so nothing here is left depending on a browser's preflight to refuse one.	checked — 44 .php files
3.5.3	A route that writes refuses a request that is not a POST, so a link somebody follows cannot make the change on their behalf.	not met — 44 .php files: extensions/product_configurator/src/admin/controller/customer/personal_data.php:321 — PersonalData::grant() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_configurator/src/admin/controller/customer/purge.php:147 — Purge::remove() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_configurator/src/admin/controller/module/product_configurator.php:377 — ProductConfigurator::save() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_configurator/src/admin/controller/module/product_configurator.php:416 — ProductConfigurator::install() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_configurator/src/admin/controller/module/product_configurator.php:539 — ProductConfigurator::uninstall() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does
4.1.1	A response carrying a body says what that body is, and the route table records the Content-Type each route sets rather than the one it ought to.	declared — 6 of 12 routes set a Content-Type of their own: 2 × Content-Type: application/json, with no charset 1 × application/json, with no charset (customer/personal_data.php:230) 1 × application/json, with no charset (customer/personal_data.php:272), sent as an attachment named for the person and the day (customer/personal_data.php:299) 1 × application/json, with no charset (customer/personal_data.php:359) 1 × application/json, with no charset (customer/purge.php:168) 3 × none set, and no output written 1 × none set; the page goes out under whatever the front controller defaults to 2 × none — nothing sets a Content-Type, so the store's default stands
5.2.1	An upload is accepted on the server's terms — what the bytes are, not what the caller said they were — and every surface that takes one is declared.	declared — 0 upload surfaces across 12 routes
5.2.2	An uploaded file is stored under a name the server chose, so nothing the caller named decides where it lands.	declared — 0 upload surfaces across 12 routes
5.3.1	Every file this extension writes says whether a browser can fetch it, and nothing it writes where a browser can reach is program code.	declared — 3 write sites, 3 of them fetchable by a browser: system/library/diary.php:437 — kyvero.log in the store's own log directory — the DIR_LOGS this class is handed, with no part of the name coming from a request — one record appended per write, at system/library/diary.php:437 system/library/diary.php:470 — the same kyvero.log, opened r+ to trim it back under the 1 MiB cap, at system/library/diary.php:470 system/library/diary.php:495 — the same kyvero.log, rewritten to what a trim kept — oldest-first, on a line boundary, under an exclusive non-blocking lock — at system/library/diary.php:495
5.3.2	Every path this extension writes to is written down beside the code, with where the name in it came from.	declared — 3 write sites, each declared with its file:line and pinned against the token stream both ways: 3 × log file
6.2.6	A field that takes a password or a key is masked, so it is not left readable on the screen or in a screenshot of it.	checked — 8 .twig files
6.2.7	A masked field does not refuse a paste or shut a password manager out of it.	checked — 8 .twig files
6.3.2	No credential is written into the source — no default account, and no password or key a reader of the shipped files could use.	checked — 44 .php files
8.1.1	Every route the extension answers is written down beside the code, with what guards it — and the gate refuses a route nobody wrote down and a written-down route nothing answers.	declared — 12 routes: 11 admin, 1 catalog, each declared beside the code
8.2.1	An admin route that changes something tests the permission itself, in a condition that can refuse — and a route that only reads says so, standing behind the check OpenCart makes before dispatch.	declared — 11 admin routes: 9 pin a permission themselves, 0 at one same-class hop, 0 at two (the hop ceiling), 2 unpinned: extensions/product_configurator/src/admin/controller/customer/purge.php:83 — Purge::index() pins no permission of its own; core checks access on extension/product_configurator/customer/purge before dispatch. No model write is reachable from it. extensions/product_configurator/src/admin/controller/module/product_configurator.php:285 — ProductConfigurator::index() pins no permission of its own; core checks access on extension/product_configurator/module/product_configurator before dispatch. No model write is reachable from it.
8.2.2	A storefront route that reaches a record says which caller may reach which records, and what selects one — so reaching somebody else's is a question with a written answer.	declared — 0 triples over 0 of 1 catalog route; the admin half is one line on the shared page
8.3.1	What bounds a caller to their own records comes from the server — a session, a stored row, the store id — and never from a value the caller supplied.	declared — 0 distinct bounds, each named by the triple it scopes
9.1.1	A secret that carries its own claim — an identity inside the string rather than a row to look up — is only believed after the signature beside it has been checked.	declared — 0 self-contained surfaces of 0 bearer-secret surfaces
9.1.2	Every hashing algorithm is a literal in the source, from a fixed allowlist, so nothing arriving in a request can choose a weaker one.	checked — 44 .php files
9.1.3	The key a signed secret is checked against comes from somewhere this extension was configured with, never from anything inside the secret itself.	declared — 0 bearer-secret surfaces, from no source at all — never from anything inside the secret presented: This extension accepts no bearer secret.
9.2.1	A secret that carries its own expiry is accepted only inside it, and the declaration says which ones carry one.	declared — 0 surfaces of 0 bearer-secret surfaces could carry a validity span inside the secret itself; the rest are a reference to a row, whose expiry is a column on it rather than a claim the caller presents: No secret this extension accepts carries its own validity span.
11.3.1	Nothing encrypts with a broken mode or padding — no ECB, no PKCS#1 v1.5.	checked — 44 .php files
11.3.2	Where anything is encrypted, the cipher is a literal in the source from a short allowlist, so nothing arriving in a request can choose a weaker one.	checked — 44 .php files
11.4.1	Every hash this extension computes is written down with what it is for, so a hash naming a cache entry is not read as one standing in front of a secret.	declared — 0 hash uses over 0 calls to 0 hash functions: This extension computes no hash.
12.1.1	No outbound request asks for a TLS version below 1.2, and none pins itself to one at all.	checked — 44 .php files
12.2.1	An outbound request is made over TLS with the certificate verified, and never falls back to cleartext.	checked — 44 .php files
12.2.2	An outbound request trusts your server's own certificate store: nothing here bundles a certificate authority of its own or turns verification off.	checked — 44 .php files
14.2.1	A credential is not carried in a URL, where a browser history, a referrer header and a proxy log each keep their own copy of it.	declared — 0 bearer-secret surfaces of 0 travel in a URL
14.3.1	Nothing is left behind in the browser's own storage for the next person at that computer to read.	checked — 8 .twig files
15.2.1	The extension bundles no third-party library, so there is nothing inside it for you to keep patched other than our own code.	checked — 44 .php files
15.3.1	What reaches a page is an enumerated set of values rather than whole database rows handed over wholesale, and every one of them is written down.	declared — 6 store-derived subtrees reaches a template of this extension, each one written down; what a model row holds beyond them does not: module_product_configurator_status — the module_product_configurator setting language_readout — core's language rows, reduced to the sentence saying which of them this screen resolved against version_warning — the store's own OpenCart version, compared against this extension's compatibility floor rules — the rules stored for one product — this extension's own product_configurator_rule and product_configurator_condition rows, carrying core's option and option-value ids. It is interpolated into a <script> element in that template rather than into markup, and it is encoded with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT swatches — the option values the storefront draws as swatches: core's product-option rows, with the image path and name core stored for each value. It is interpolated into a <script> element in that template rather than into markup, and it is encoded with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT edit — the cart line this visit is reopening, resolved against the shopper's own session cart: the answers it holds and the quantity. It is interpolated into a <script> element in that template rather than into markup, and it is encoded with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
16.2.5	No log line names a credential — no token, secret, signature or password is written into the file the error log screen renders.	checked — 44 .php files
16.4.1	Everything written to the error log is escaped first, so nothing a store holds can forge a record or close the box a merchant reads the log in.	checked — 44 .php files
16.5.1	No error message carrying internal detail — a database driver puts the failing statement in one — is thrown onward or rendered to a response.	checked — 44 .php files