Security verdict

21 checked, 2 not met, 22 declared, 0 not checked — 45 controls in the baseline.

Each control below is defined on the security baseline, which also says what each of the four states means. declared is not a pass.

Control	What it checks	State, scope and what is left
KYV-1	A secret an untrusted caller presents is compared in constant time and refused when it is unset — and where this extension mints it rather than taking core's or a merchant's, it carries at least 128 bits from a cryptographic random source.	declared — 0 bearer-secret surfaces over 0 mint, compare and refuse sites (0 × mint, 0 × constant-time compare, 0 × compare, 0 × refusal)
1.2.1	Store data meets markup safely where the danger is decidable — an unquoted attribute, a URL the template composed itself, a style, hand-built XML — and every store-derived subtree a template of this extension renders is written down beside the code. Beyond those two, nothing is claimed, and the page says so.	declared — machine-pass on the sinks: 0 sink sites asserted here, 0 not admitted; attested over the inventory: 7 store-derived subtrees over 2 templates; unverified beyond it: everything else: module_product_filters_status — the module_product_filters setting, for the store the form is showing. Rendered by admin/view/template/module/product_filters.twig. stores — core's setting/store model: each store's id and the name the store owner gave it. Rendered by admin/view/template/module/product_filters.twig. facets — on the storefront, the facet engine: each brand's manufacturer.name, each core filter's and filter group's name, each list option's and option value's name, and each attribute's attribute_description.name and its product_attribute.text (the dictionary keeps the first spelling written), as the merchant saved them through core's admin forms (entity-encoded by core's request cleaning on the way in, as every core template renders it), their ids and a count — attribute text is also a checkbox value, double-quoted, which core's encoding covers; for the Price facet, the lowest and highest tile price of the listing and the bounds the visitor typed, which the URL grammar has reduced to unsigned decimals; each category's category_description.name in the viewer's language, saved the same way, its id and a count; on the settings form, the Facets list: each filter group, option and attribute name as saved through core's admin forms, entity-encoded the same way, with its ids, status and sort order. Rendered by catalog/view/template/module/product_filters.twig, admin/view/template/module/product_filters.twig. hidden — the listing's own query parameters (what core's pagination carries there — path, filter, manufacturer_id, search, tag, description, category_id, sub_category — plus sort, order, limit and language) after core's request cleaning, read back out of the link core's url->link() built from them; escaped again in the template. Rendered by catalog/view/template/module/product_filters.twig. action — the part before ? of the link core's url->link() built to the listing. Rendered by catalog/view/template/module/product_filters.twig. chips — one per selected value: the value's name as facets carries it, the facet's name from the language file, and a link that is the listing's url->link() with the effective selection minus that value appended by http_build_query(), so every value in it is URL-encoded and none is request text; and one for a typed price range, named from the bounds the URL grammar has reduced to unsigned decimals between the currency's own symbols, linking to the selection without the range. Rendered by catalog/view/template/module/product_filters.twig. clear — the link core's url->link() built to the listing, without the selection. Rendered by catalog/view/template/module/product_filters.twig. Unverified beyond it: the other 192 of 208 template expressions in 6 templates, and any $data subtree nobody enumerated. The inventory is an inventory and not a bound: completeness over the whole expression surface is unverifiable, so this residual is permanent, and it is published rather than left to be inferred from what is missing.
1.2.2	A URL a template builds for itself, rather than taking one whole from the link helper, has every value in it URL-encoded — so nothing a store holds can add a parameter of its own or change where the link goes.	declared — 16 url attributes carrying a template expression, of 16 sink sites asserted: Every url attribute in this extension's templates takes its value whole from the link helper.
1.2.3	No template expression is interpolated into a <script> element, so store data cannot end a string literal and start running.	not met — 6 .twig files: extensions/product_filters/src/admin/view/template/customer/personal_data.twig:154 — {{ erase }} is interpolated inside a <script> element extensions/product_filters/src/admin/view/template/customer/purge.twig:71 — {{ remove }} is interpolated inside a <script> element
1.2.4	Every way this extension builds a database statement is written down beside the code, so how a value reaches a query is a published answer rather than something to go looking for.	declared — 3 ways of building a statement, over 27 statements run and 9 values escaped: statements built from numbers and the table prefix only — the facet engine, the index writer, the base-set builder, the Facets list, the Price facet and the membership sources (system/library/engine.php, indexer.php, base.php, facets.php, price.php, source/brand.php, source/category.php, source/grouped.php, source/filter.php, source/option.php) compose every statement out of the prefix, fixed literals and values cast with (int) or intval — store, language, group, product, order, brand, filter, option, category and tax class ids, the ids a variant's variant JSON names, the id-list part of the selection, which the URL grammar has already reduced to positive integers, and the posted Facets list, cast field by field — and out of numbers: a typed price bound, which the grammar has reduced to an unsigned decimal of at most twelve digits and eight places and which reaches SQL as those digits, and tax and currency factors formatted with sprintf('%.10F'). The sources hand their own composed SELECTs to a private runner, which is the statements counted as handed over below. No request text reaches one. The one string they carry whole is on the search page: Product Search's published product_search_matched statement, built in-process by Product Search from integers and escaped text, which Base::search() wraps in an IN and never runs alone attribute text escaped by the driver — the Attribute source (system/library/source/attribute.php) is the one place request text reaches a statement: the selected attribute text, which resolve() re-encodes with htmlspecialchars() as core stores it and passes through $db->escape() inside single quotes. Every other value in its statements is the prefix or an id cast with (int) or intval a statement handed over already built — the COUNT(*) PurgeCounts::total() runs is composed by its caller and arrives as a string (admin/model/customer/purge_counts.php). Nothing in this scaffold composes one yet; the first counts() that does will interpolate a table name the declaration owns between backticks, and that mechanism belongs here beside this one 9 of the 27 statements are handed over already built, so what a rule reading the call site alone can see stops there; which mechanism built them is what the lines above say.
1.2.5	Nothing runs a command through the shell — no backtick, no exec() — so no value a store holds can become part of one.	checked — 57 .php files
1.3.1	No screen binds a rich-text editor whose HTML this extension would then render back out, because nothing here sanitises HTML and no sanitiser ships with it.	checked — 6 .twig files
1.3.2	Nothing runs code it assembled while running — no eval(), and no include of a path a variable decided.	checked — 57 .php files
1.5.1	Every XML parser is left at the restrictive default: nothing turns on external entity resolution, which is what would turn reading a spreadsheet into reading your server's files.	checked — 57 .php files
3.2.1	Every route declares the response type it sets, as the code sets it, so nothing is left for a browser to re-interpret as something it is not.	declared — 6 of 13 routes set a Content-Type of their own: 5 × Content-Type: application/json, with no charset 1 × application/json, with no charset (customer/personal_data.php:272), sent as an attachment named for the person and the day (customer/personal_data.php:299) 2 × none set, and no output written 1 × none set; the fragment goes out under whatever the front controller defaults to 3 × none set; the page goes out under whatever the front controller defaults to 1 × none — the 404 body is plain text with no type set
3.2.2	Every place a script hands a value to the page as markup rather than as text is written down beside the code, with what it puts there.	declared — 5 call sites in 2 templates, each declared with what it writes there: 2 × .append( 3 × .prepend(
3.3.1	A cookie this extension sets carries the Secure attribute at the call that sets it, so a browser cannot send it back over plain HTTP.	checked — 57 .php files
3.4.2	A cross-origin header is a fixed value this code chose — never a wildcard, and never the origin the caller asked for.	checked — 57 .php files
3.5.1	Every route that changes something says what stands between it and a request another website caused a visitor's browser to make.	declared — 5 routes of 13 reaches a model write; the 5 admin ones among them stand behind the user_token core checks before dispatch, and 11 admin routes are gated that way in all: No storefront route of this extension reaches a model write.
3.5.2	No route grants a cross-origin caller anything, so nothing here is left depending on a browser's preflight to refuse one.	checked — 57 .php files
3.5.3	A route that writes refuses a request that is not a POST, so a link somebody follows cannot make the change on their behalf.	not met — 57 .php files: extensions/product_filters/src/admin/controller/customer/personal_data.php:321 — PersonalData::grant() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_filters/src/admin/controller/customer/purge.php:147 — Purge::remove() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_filters/src/admin/controller/module/product_filters.php:128 — ProductFilters::save() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_filters/src/admin/controller/module/product_filters.php:219 — ProductFilters::install() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does extensions/product_filters/src/admin/controller/module/product_filters.php:388 — ProductFilters::uninstall() writes through a model and never reads REQUEST_METHOD, so a GET anybody can cause does the same thing a POST does
4.1.1	A response carrying a body says what that body is, and the route table records the Content-Type each route sets rather than the one it ought to.	declared — 6 of 13 routes set a Content-Type of their own: 5 × Content-Type: application/json, with no charset 1 × application/json, with no charset (customer/personal_data.php:272), sent as an attachment named for the person and the day (customer/personal_data.php:299) 2 × none set, and no output written 1 × none set; the fragment goes out under whatever the front controller defaults to 3 × none set; the page goes out under whatever the front controller defaults to 1 × none — the 404 body is plain text with no type set
5.2.1	An upload is accepted on the server's terms — what the bytes are, not what the caller said they were — and every surface that takes one is declared.	declared — 0 upload surfaces across 13 routes
5.2.2	An uploaded file is stored under a name the server chose, so nothing the caller named decides where it lands.	declared — 0 upload surfaces across 13 routes
5.3.1	Every file this extension writes says whether a browser can fetch it, and nothing it writes where a browser can reach is program code.	declared — 3 write sites, 3 of them fetchable by a browser: system/library/diary.php:437 — kyvero.log in the store's own log directory — the DIR_LOGS this class is handed, with no part of the name coming from a request — one record appended per write, at system/library/diary.php:437 system/library/diary.php:470 — the same kyvero.log, opened r+ to trim it back under the 1 MiB cap, at system/library/diary.php:470 system/library/diary.php:495 — the same kyvero.log, rewritten to what a trim kept — oldest-first, on a line boundary, under an exclusive non-blocking lock — at system/library/diary.php:495
5.3.2	Every path this extension writes to is written down beside the code, with where the name in it came from.	declared — 3 write sites, each declared with its file:line and pinned against the token stream both ways: 3 × log file
6.2.6	A field that takes a password or a key is masked, so it is not left readable on the screen or in a screenshot of it.	checked — 6 .twig files
6.2.7	A masked field does not refuse a paste or shut a password manager out of it.	checked — 6 .twig files
6.3.2	No credential is written into the source — no default account, and no password or key a reader of the shipped files could use.	checked — 57 .php files
8.1.1	Every route the extension answers is written down beside the code, with what guards it — and the gate refuses a route nobody wrote down and a written-down route nothing answers.	declared — 13 routes: 11 admin, 2 catalog, each declared beside the code
8.2.1	An admin route that changes something tests the permission itself, in a condition that can refuse — and a route that only reads says so, standing behind the check OpenCart makes before dispatch.	declared — 11 admin routes: 9 pin a permission themselves, 0 at one same-class hop, 0 at two (the hop ceiling), 2 unpinned: extensions/product_filters/src/admin/controller/customer/purge.php:83 — Purge::index() pins no permission of its own; core checks access on extension/product_filters/customer/purge before dispatch. No model write is reachable from it. extensions/product_filters/src/admin/controller/module/product_filters.php:43 — ProductFilters::index() pins no permission of its own; core checks access on extension/product_filters/module/product_filters before dispatch. No model write is reachable from it.
8.2.2	A storefront route that reaches a record says which caller may reach which records, and what selects one — so reaching somebody else's is a question with a written answer.	declared — 2 triples over 2 of 2 catalog routes; the admin half is one line on the shared page: extension/product_filters/module/product_filters — nobody — the panel is the same for every visitor to a product listing: The panel renders on a product listing's page and nowhere else, whatever layout it is placed on, and only shows brands and categories assigned to the store it is on, and core filters and list options that have a name in the visitor's language. Selected by none — not a record; route is read only to decide whether the page is one of the four product listings, compared against a fixed list, and pf only as a list of positive integers, each resolved against this store's own brands, the categories core would list on that page for this store and language, or a filter or list option value with a name in the viewer's language — and, under pf[attr], as text keyed by a positive attribute id, matched against the attribute text this store's products carry, and under pf[price] as two unsigned decimals — before it narrows anything extension/product_filters/cron/product_filters — OpenCart's own scheduler: The nightly rebuild runs only when OpenCart's own scheduler dispatches it; a typed URL gets a 404. Selected by none — not a record; the route reads no request key at all and rebuilds the whole index
8.3.1	What bounds a caller to their own records comes from the server — a session, a stored row, the store id — and never from a value the caller supplied.	declared — 2 distinct bounds, each named by the triple it scopes: bounded by the $cron_id argument core's dispatcher supplies; nothing in the request scopes anything bounded by the store id from config: a brand outside manufacturer_to_store, or a category outside category_to_store, for this store neither appears nor filters
9.1.1	A secret that carries its own claim — an identity inside the string rather than a row to look up — is only believed after the signature beside it has been checked.	declared — 0 self-contained surfaces of 0 bearer-secret surfaces
9.1.2	Every hashing algorithm is a literal in the source, from a fixed allowlist, so nothing arriving in a request can choose a weaker one.	checked — 57 .php files
9.1.3	The key a signed secret is checked against comes from somewhere this extension was configured with, never from anything inside the secret itself.	declared — 0 bearer-secret surfaces, from no source at all — never from anything inside the secret presented: This extension accepts no bearer secret.
9.2.1	A secret that carries its own expiry is accepted only inside it, and the declaration says which ones carry one.	declared — 0 surfaces of 0 bearer-secret surfaces could carry a validity span inside the secret itself; the rest are a reference to a row, whose expiry is a column on it rather than a claim the caller presents: No secret this extension accepts carries its own validity span.
11.3.1	Nothing encrypts with a broken mode or padding — no ECB, no PKCS#1 v1.5.	checked — 57 .php files
11.3.2	Where anything is encrypted, the cipher is a literal in the source from a short allowlist, so nothing arriving in a request can choose a weaker one.	checked — 57 .php files
11.4.1	Every hash this extension computes is written down with what it is for, so a hash naming a cache entry is not read as one standing in front of a secret.	declared — 0 hash uses over 0 calls to 0 hash functions: This extension computes no hash.
12.1.1	No outbound request asks for a TLS version below 1.2, and none pins itself to one at all.	checked — 57 .php files
12.2.1	An outbound request is made over TLS with the certificate verified, and never falls back to cleartext.	checked — 57 .php files
12.2.2	An outbound request trusts your server's own certificate store: nothing here bundles a certificate authority of its own or turns verification off.	checked — 57 .php files
14.2.1	A credential is not carried in a URL, where a browser history, a referrer header and a proxy log each keep their own copy of it.	declared — 0 bearer-secret surfaces of 0 travel in a URL
14.3.1	Nothing is left behind in the browser's own storage for the next person at that computer to read.	checked — 6 .twig files
15.2.1	The extension bundles no third-party library, so there is nothing inside it for you to keep patched other than our own code.	checked — 57 .php files
15.3.1	What reaches a page is an enumerated set of values rather than whole database rows handed over wholesale, and every one of them is written down.	declared — 7 store-derived subtrees reaches a template of this extension, each one written down; what a model row holds beyond them does not: module_product_filters_status — the module_product_filters setting, for the store the form is showing stores — core's setting/store model: each store's id and the name the store owner gave it facets — on the storefront, the facet engine: each brand's manufacturer.name, each core filter's and filter group's name, each list option's and option value's name, and each attribute's attribute_description.name and its product_attribute.text (the dictionary keeps the first spelling written), as the merchant saved them through core's admin forms (entity-encoded by core's request cleaning on the way in, as every core template renders it), their ids and a count — attribute text is also a checkbox value, double-quoted, which core's encoding covers; for the Price facet, the lowest and highest tile price of the listing and the bounds the visitor typed, which the URL grammar has reduced to unsigned decimals; each category's category_description.name in the viewer's language, saved the same way, its id and a count; on the settings form, the Facets list: each filter group, option and attribute name as saved through core's admin forms, entity-encoded the same way, with its ids, status and sort order hidden — the listing's own query parameters (what core's pagination carries there — path, filter, manufacturer_id, search, tag, description, category_id, sub_category — plus sort, order, limit and language) after core's request cleaning, read back out of the link core's url->link() built from them; escaped again in the template action — the part before ? of the link core's url->link() built to the listing chips — one per selected value: the value's name as facets carries it, the facet's name from the language file, and a link that is the listing's url->link() with the effective selection minus that value appended by http_build_query(), so every value in it is URL-encoded and none is request text; and one for a typed price range, named from the bounds the URL grammar has reduced to unsigned decimals between the currency's own symbols, linking to the selection without the range clear — the link core's url->link() built to the listing, without the selection
16.2.5	No log line names a credential — no token, secret, signature or password is written into the file the error log screen renders.	checked — 57 .php files
16.4.1	Everything written to the error log is escaped first, so nothing a store holds can forge a record or close the box a merchant reads the log in.	checked — 57 .php files
16.5.1	No error message carrying internal detail — a database driver puts the failing statement in one — is thrown onward or rendered to a response.	checked — 57 .php files