First version of the security module

modules/security/lib/Module/Security/Service/SecurityMarkdownGateway.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace MintyPHP\Module\Security\Service;
+
+use League\CommonMark\GithubFlavoredMarkdownConverter;
+
+/**
+ * Renders check-template Markdown guidance to sanitized HTML.
+ *
+ * Hardened config: raw HTML in the source is escaped (html_input=escape) and
+ * unsafe links (javascript:, data:, …) are dropped (allow_unsafe_links=false),
+ * so author-entered content can never inject markup/script into the workspace.
+ *
+ * @api Consumed by the security check workspace action to pre-render per-item guidance.
+ */
+final class SecurityMarkdownGateway
+{
+    private ?GithubFlavoredMarkdownConverter $converter = null;
+
+    public function toHtml(string $markdown): string
+    {
+        $markdown = trim($markdown);
+        if ($markdown === '') {
+            return '';
+        }
+
+        $this->converter ??= new GithubFlavoredMarkdownConverter([
+            'html_input' => 'escape',
+            'allow_unsafe_links' => false,
+        ]);
+
+        return (string) $this->converter->convert($markdown);
+    }
+}