How to Test Joomla Extensions for Security

Extension security - is not an optional feature, but the foundation that determines the fate of the entire site. Even a single weak point in the code can turn the system into an open door for attacks. The key vulnerabilities through which Joomla extensions are most often compromised are examined, along with practical methods to prevent them. Tools and approaches are also covered that help identify issues before attackers do.

Developing an extension requires a strict approach to data protection. Even if the Joomla core is secure, mistakes in extension code can open access to attackers. Below are the most common vulnerabilities, along with methods to prevent and test them.

Top 5 extension vulnerabilities

1. SQL injection: direct access to the database

Passing user data directly into an SQL query - is one of the most critical mistakes. It is equivalent to leaving the database door wide open.

// ❌ VULNERABLE
$id = $app->input->get('id');
$db = $this->getDatabase();
$query = 'SELECT * FROM #__mycomponent_items WHERE id = ' . $id;
$db->setQuery($query);
$result = $db->loadObjectList();

An attacker can inject a value like id=1 OR 1=1 and gain access to the entire table. Modern attacks have long been automated and operate at scale.

Correct approach: strict filtering, type casting, and the use of parameterized queries.

// ✅ SAFE
$id = (int) $app->input->getInt('id');
$db = $this->getDatabase();
$query = $db->getQuery(true)
    ->select($db->quoteName('*'))
    ->from($db->quoteName('#__mycomponent_items'))
    ->where($db->quoteName('id') . ' = :id')
    ->bind(':id', $id, \Joomla\Database\ParameterType::INTEGER);
$db->setQuery($query);
$result = $db->loadObject();

Conclusion: any user input must be filtered and used only through bound parameters.

2. XSS (Cross-Site Scripting): malicious code inside the page

One of the most common vulnerabilities. Malicious JavaScript can be injected into a page and execute actions on behalf of the user.

<div class="review">
   <?php echo $review->text; ?>
</div>

If the data is not filtered, a user can insert a script:

Some text <script>/* malicious code */</script>

This code will execute silently, intercepting data, cookies, and user actions.

What to do: filter incoming data and escape output. In PHP use htmlspecialchars(), in JavaScript - textContent instead of innerHTML.

3. CSRF: forged user actions

The attack occurs when a user is authenticated on a site but performs an action through a malicious request.

Solution - using tokens:

<?php echo HTMLHelper::_('form.token'); ?>

The token must be validated on the server. Without it, the request should be rejected.

Important: token validation - is mandatory for all forms and AJAX requests.

4. File uploads: injecting malicious files

Allowing file uploads without control - is a direct path to site compromise.

Main risks:

uploading PHP scripts, MIME type spoofing, uploading malicious archives.

Solution: strict validation of file types, sizes, and extensions. Use built-in Joomla tools such as MediaHelper.

5. Directory Traversal: escaping the directory boundaries

Using sequences like ../ allows access to files outside the allowed directory.

To prevent this, sanitize file names:

Joomla\Filesystem\File::makeSafe($fileName);

All file paths and names must be filtered.

Security testing tools

Security testing must be performed before deployment to production. Specialized tools are used:

OWASP ZAP - automated vulnerability scanner.
Burp Suite - request analysis and interception.
SQLMap - SQL injection detection.

These tools help identify weak points before they are exploited.

Testing with PHPStan, PHPUnit and Cypress

PHPStan: static analysis

Helps detect type and logic errors. Running at a high strictness level helps identify potential vulnerabilities at the development stage.

PHPUnit: logic testing

public function it_escapes_xss_in_output()
{
    $input = '<script>alert("xss")</script>';
    $sanitised = $this->sanitise($input);
    $this->assertStringNotContainsString('<script>', $sanitised);
}

Such tests ensure that malicious code does not pass through sanitization.

Cypress: end-to-end testing

cy.get('[data-cy="search-input"]').type('<script>alert(1)</script>');

It verifies whether the script executes or is correctly displayed as text.

Standards and vulnerability databases

OWASP

Provides a list of Top 10 vulnerabilities and practical security recommendations. This is essentially mandatory knowledge for developers.

CVE

A global vulnerability registry. Each issue has its own identifier. Studying the database helps understand real attack scenarios and avoid repeating others’ mistakes.

Conclusion

Security - is not a final step, but an ongoing process. Most attacks use a combination of vulnerabilities rather than a single flaw. The earlier protection and testing are implemented, the lower the risk of critical issues in the future.

Core principle: never trust incoming data under any circumstances.

---