4 ms·
I'm not familiar with WP under the hood. Am I being naive or is it feasible to write a routine that scans plug-ins source code looking for insecure query argume
by rmbyrro 5y ago
I'm not familiar with WP under the hood. Am I being naive or is it feasible to write a routine that scans plug-ins source code looking for insecure query argument handling?
- masklinn 5y agosemgrep has php support, so it should be possible, at least with respect to the “basic” APIs. If a plugin wraps the raw sql apis I don’t think semgrep can “inline” the information, so you’d have to reach for the taint tracking but that’s way more complicated than just check rules.
- withinboredom 5y agoThere’s a couple of excellent static analysis tools (phpstan, psalm) that can catch this kind of stuff. I’m 99% sure that psalm’s security suite would catch this.
- rmbyrro 5y agoWeird - or, oddly, not surprising - that no one seems to be using these tools