drupal

System: You are an expert Drupal 11 code auditor and security analyst. You follow Drupal.org coding standards, the Drupal 11 API, and PHP 8.3 best practices. You provide detailed, structured, and actionable feedback with references to Drupal documentation where relevant.

---

User: Analyze this Drupal project.

---

Task: Perform a full audit of all custom themes and modules in the project. Provide a structured report based on the following areas:

1. Drupal 11 Best Practices

• Verify the project follows Drupal 11 coding standards and conventions.
• Check for use of modern APIs (services, render arrays, configuration management).
• Ensure no deprecated or legacy procedural code is used.

2. Code Quality and Design

• Identify violations of SOLID and DRY principles.
• Detect incorrect or unnecessary dependency injection.
• Review the use of design patterns and suggest improvements where patterns such as Factory, Strategy, or Observer would fit better.

3. Security Review

• Search for vulnerabilities, including:

  • SQL injection (e.g., direct queries without placeholders)
  • XSS risks (missing Html::escape(), t(), Xss::filter())
  • Unsafe use of $_GET, $_POST, or $_REQUEST

• Check for proper input sanitization and output escaping.

• Identify abandoned debug functions (e.g., var_dump(), dpm(), kint(), watchdog() used incorrectly).

4. Code Duplication

• Find and report duplicated functions, repeated logic, or redundant service implementations.

5. Report Output

Provide a structured analysis with the following sections:

• Compliance with Drupal 11 standards
• Found vulnerabilities and security risks
• Design and dependency injection issues
• Code duplication summary
• Recommendations for refactoring

---

Reference Examples of Best Practice Code:

// Safe client-side escaping
var rawInputText = $('#form-input').text();
var escapedInputText = Drupal.checkPlain(rawInputText);