fix(security): Divi-markup refusal sees content as storage will (ruling S52)

Control characters removed by kses (wp_kses_no_null: C0, \\0 sequences)
or ControlChars (DEL) could hide a divi/* delimiter or an et_pb shortcode
from the raw-input check. The shared DiviMarkup helper checks the raw
and the normalized form and now guards every raw-content path:
content-create/-update content and media-update description (attachment
post_content). MediaImporter logs import failures with scheme, host,
port and path only; uninstall.php lists the removed user meta.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Media/MediaImporter.php

@@ -367,10 +367,23 @@ class MediaImporter
         return PublicAddress::hostIsPublic((string) wp_parse_url($url, PHP_URL_HOST), $this->resolve);
     }
 
+    /** Scheme, host, port and path of $url – no credentials, query string or fragment in the log. */
+    private static function loggableUrl(string $url): string
+    {
+        $parts = wp_parse_url($url);
+        if (! is_array($parts)) {
+            return '(ungültige URL)';
+        }
+
+        $port = isset($parts['port']) ? ':' . (int) $parts['port'] : '';
+
+        return sprintf('%s://%s%s%s', $parts['scheme'] ?? '', $parts['host'] ?? '', $port, $parts['path'] ?? '');
+    }
+
     /** One message for every network failure (security audit M3); the reason is logged only. */
     private function downloadFailed(string $url, string $reason): WP_Error
     {
-        Log::failure('media import from ' . $url, $reason);
+        Log::failure('media import from ' . self::loggableUrl($url), $reason);
 
         return Errors::invalidInput(
             'Die Datei konnte nicht geladen werden.',

src/Integrations/Media/MediaUpdateAbility.php

@@ -6,6 +6,7 @@ namespace LIT\MCP\Integrations\Media;
 
 use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\Annotations;
+use LIT\MCP\Abilities\DiviMarkup;
 use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Abilities\FollowUp;
 use LIT\MCP\Abilities\Rollback;
@@ -212,6 +213,10 @@ final class MediaUpdateAbility implements Ability
             if (! is_string($item[$key]) || mb_strlen($item[$key]) > $max) {
                 return Errors::invalidInput(sprintf('%s: Text mit höchstens %d Zeichen erwartet.', $key, $max));
             }
+            // description is the attachment's post_content (ruling S52).
+            if ($key === 'description' && DiviMarkup::contains($item[$key])) {
+                return Errors::invalidInput('description: Divi-Markup ist nicht erlaubt.', [], DiviMarkup::HINT);
+            }
             $changes[$key] = in_array($key, ['alt', 'title'], true)
                 ? sanitize_text_field($item[$key])
                 : wp_kses_post($item[$key]);