security: harden Syslog CSV exports and imports

[somethingwithproof]

Summary

• Neutralize formula-leading values in both Syslog CSV export paths without mutating message data.
• Disable fputcsv() backslash escaping to prevent attacker-controlled field splitting and PHP 8.4+ deprecation output.
• Cap pasted and uploaded XML imports at 5 MiB before reading them into memory.
• Replace the polluted seven-commit branch history with one focused commit based on current develop.

Validation

• PHP 8.3 syntax checks for changed sources and regression tests.
• tests/regression/issue277_import_payload_loader_test.php.
• tests/regression/issue256_262_csv_import_hardening_test.php, including an RFC-style CSV round trip and oversized text-import subprocess.
• Full local critical/high review pipeline: production changes clean; remaining process finding is that regression scripts must be wired into CI by ci: enforce regression tests and harden import loading #329/test: add security regression and Docker E2E infrastructure #320.

CI dependency

PHP 8.1 and 8.2 currently fail before plugin tests because the base workflow requests unavailable versioned Apache PHP packages. PR #329 is the prerequisite CI repair.

Compatibility

Uses PHP 8.0-compatible language features and Cacti helper conventions.

Refs #256 and #262.

[Copilot]

Pull request overview

This PR hardens the Syslog plugin against common output- and import-related security issues by escaping guest-visible stored content, preventing spreadsheet formula injection in CSV exports, and limiting import payload sizes to reduce memory risk.

Changes:

• Escape stored alert HTML before rendering in the alarm viewer.
• Add an import payload size cap and centralize CSV cell hardening for exports.
• Add regression coverage for the hardening and update CI to pin the Cacti checkout ref and adjust job steps.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
syslog.php	Escapes stored alarm HTML output (and preserves newlines via nl2br).
functions.php	Adds import-size guard and CSV cell hardening helper; updates CSV export to use it.
tests/regression/issue318_output_import_hardening_test.php	New regression test covering CSV formula hardening + alarm viewer escaping.
tests/regression/issue277_import_payload_loader_test.php	Updates regression assertions for the shared import payload loader.
.github/workflows/plugin-ci-workflow.yml	Pins Cacti checkout ref and adjusts lint/dependency steps in CI.

Suppressed comments (2)

tests/regression/issue277_import_payload_loader_test.php:39

• str_contains() is PHP 8+ only. If this repo/PR intends to remain PHP 7.4-compatible, switch this check back to strpos(...) === false.

if (!str_contains($functions, "trim(get_nfilter_request_var('import_text')) !== ''")) {

tests/regression/issue318_output_import_hardening_test.php:44

• str_contains() is PHP 8+ only. If this repo/PR intends to remain PHP 7.4-compatible, use strpos(...) === false for this source scan (preserving the existing needle string).

if (!str_contains($syslog, 'nl2br(html_escape(trim($html, "\' ")))')) {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.