helpers/OutputHelper.php is dead code despite being documented as part of the security architecture #54

New Issue

2026-08-31T21:36:21-04:00

jared commented

2026-08-31 21:36:21 -04:00

Severity: Low / docs

grep -rl "OutputHelper::" across the whole app returns only helpers/OutputHelper.php itself — zero callers anywhere. README.md lists it under the file reference as "Safe HTML output helpers" and implies it's part of the app's XSS-prevention story, but every view actually calls htmlspecialchars() directly instead (which a prior audit round confirmed is done consistently). Not an active vulnerability — escaping is happening correctly via the direct calls — just a misleading, unused class.

Fix: Either wire OutputHelper in as the actual escaping helper used across views (consolidating the direct htmlspecialchars() calls), or delete the dead file and remove it from the README's file reference.

**Severity:** Low / docs `grep -rl "OutputHelper::"` across the whole app returns only `helpers/OutputHelper.php` itself — zero callers anywhere. README.md lists it under the file reference as "Safe HTML output helpers" and implies it's part of the app's XSS-prevention story, but every view actually calls `htmlspecialchars()` directly instead (which a prior audit round confirmed is done consistently). Not an active vulnerability — escaping is happening correctly via the direct calls — just a misleading, unused class. **Fix:** Either wire `OutputHelper` in as the actual escaping helper used across views (consolidating the direct `htmlspecialchars()` calls), or delete the dead file and remove it from the README's file reference.