How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?

Question

I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "security_review_known_risky_fields" system variable ? Can somebody provide an example on how to do this? I am not sure exactly what the entry in the variable table should look like.

Answer 1

In settings.php add the following:

$conf['security_review_known_risky_fields'] = implode(
  ',',
  array(
    'xxx',
    'yyy',
    'zzz'
  ),
);

...where 'xxx', 'yyy', and 'zzz' are the content hash strings shown for each problematic file in the Security Review report.

Answer 2

The README says to create "a SHA-256 hash of the entity_id, entity_type, and field contents". It looks like you have to call hash('sha256', $entity_id.$entity_type.$field_contents) and save that in the security_review_known_risky_fields string variable, which can be done in settings.php. If there are multiple fields you want to allow, separate their respective hashes with commas.