[somethingwithproof]

This change proposes a common approach to safely rendering text, attributes, URLs, script data and formatted HTML in Cacti. The architecture document describes how existing helpers and selected Symfony components could support that work, with compatibility and testing requirements. It gives maintainers a reviewable implementation plan; it does not implement the migration or resolve security findings.

Summary

Cacti's renderers mix plain text, attributes, URLs, script data, and intentional HTML. Add proposed ADR 0003 with an implementation plan and an assessment of the Symfony components already available.

Reuse CactiValidator::validate() or isValid() for established option contracts where needed, keeping session-writing validation out of renderers. Continue using Cacti's context-specific output helpers. HttpFoundation has a limited role at dedicated JSON response boundaries; OptionsResolver is currently development-only. HTML Sanitizer, Twig, and Symfony Form require separate dependency decisions.

The plan starts with a caller inventory and hidden-field pilot, followed by shared text/attribute helpers and filter script data. Optional formatted-HTML and Twig pilots follow separately. It defines caller compatibility, maintenance-branch propagation, dependency requirements, and regression/rescan acceptance criteria.

Scope

Targets develop and updates the ADR index. This is a documentation proposal for maintainer review; it changes no runtime behavior or dependencies and claims no security finding resolved. Necessary 1.2.x fixes remain independent of framework migration. Finding-specific evidence stays in the private security-reporting process.

Validation

• Reviewed the final diff against the current helper APIs, representative callers, Composer manifest/lock, existing test suites, and official Symfony/Twig guidance. A complete core/plugin caller audit remains an implementation prerequisite.
• Clean locked Composer install under PHP 8.5.11 selected through mise.
• Repository PHP CS Fixer: 437 files checked, zero changes.
• Repository PHPStan: 465 files, no errors.
• Markdown lint, eight relative documentation links, changelog validation, and git diff --check passed.
• Runtime regression tests are deferred to implementation PRs; this PR changes Markdown only.

At head 65aaf8e, locked integration failed before checkout because ECR rejected the MariaDB image download with toomanyrequests: Data limit exceeded. Other checks were still running when inspected. This is an infrastructure failure, not a passing integration result: https://github.com/Cacti/cacti/actions/runs/39393378436/job/118530036126

No release-note fragment is added because this records a proposed approach rather than a shipped behavior change.

Revision and checks

Description scope: target develop, 2 changed files, head fd10e7b4a. Checked 2026-10-23 03:06:04 UTC.

GitHub check snapshot: 2 passed. Local test figures and earlier CI runs above are recorded evidence for their stated revisions and environments; they do not assert that every check passes at this head.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud