Security

Security considerations for WPZylos Assets.

Script Injection Prevention

Always escape data passed to localize():

// Good: Safe — data is JSON-encoded by wp_localize_script
$assets->script('app')->localize('Config', [
    'message' => sanitize_text_field($userInput),
]);

// Bad: Dangerous — raw user input in inline script
$assets->script('app')->inline('var msg = "' . $_GET['msg'] . '";');

// Good: Safe — escape properly
$assets->script('app')->inline('var msg = ' . wp_json_encode(sanitize_text_field($_GET['msg'] ?? '')) . ';');

CSS Injection Prevention

// Good: Safe — sanitize CSS values
$assets->style('theme')->inline(
    ':root { --color: ' . esc_attr($color) . '; }'
);

// Bad: Dangerous — unsanitized CSS
$assets->style('theme')->inline($_POST['custom_css']);

Content Security Policy

When using ES modules or inline scripts, ensure your CSP headers allow them:

// If using nonces for CSP
add_filter('script_loader_tag', function ($tag, $handle) {
    return str_replace(' src', ' nonce="' . wp_create_nonce('csp') . '" src', $tag);
}, 10, 2);

External Asset Validation

Only load scripts from trusted CDNs:

$assets->script('analytics')
    ->url('https://www.googletagmanager.com/gtag/js?id=GA_ID');

Use Subresource Integrity (SRI) when available for external resources.

Testing

Troubleshooting