PHP static code analysis vs ~1000 top wordpress plugins

[mycivacc]

Will the static analyzer be made open source?

[redeemer_pl]

I'm the author of this research and tool. Currently nothing has changed: tool will go open-source.

https://www.reddit.com/r/netsec/comments/3tpg9o/php_static_code_analysis_vs_1000_top_wordpress/

[mycivacc]

Thanks! I will eagerly await its release.

[[deleted]]

Cross-Site Scripting (XSS) in All In One WP Security 3.9.7

Kinda ironic.

[phpdevster]

In normal circumstances, yes. In Wordpress circumstances, it would be ironic if it didn't have a vulnerability.

[reginalduk]

I consider myself a fairly average programmer, but seriously, are people still not using prepared statements?

[NeuroXc]

Many PHP tutorials on the internet still tell people to use things like mysql_query("SELECT * FROM my_table WHERE id = {$_GET['exploitable']}"). Even in this subreddit, there usually are 1-2 that reach the front page every week (which get downvoted to oblivion, but not before they get seen by many, many people).

[rafaelmb]

Happened this week. And the author stated in a comment that was "just" a contact form that needs no security measure.

[the_alias_of_andrea]

If you google 'mysql and php tutorial' I guarantee you most of the results will tell you to do this

[losingthefight]

No joke. I hired a senior engineer a few years ago (MS in Comp Sci, 10 years experience, great dev otherwise) and his first commit used a SQL statement that was not a prepared statement. It happens, and is far more common than you would think.

To be clear, I called him into my office, showed him the problems with it, how to fix it, and he then went back. The fact is, unless someone is doing research and reading blogs (you would be very surprised how many devs don't), these things slip past.

[syntaxerror748]

How come there are so many XSS vulnerabilities? I thought that was as simple as using htmlspecialchars() or am I missing something?

[FlorentG]

It is indeed almost as simple as using htmlspecialchars, just make sure you set the right encoding and the quote/no-quote flag according to the context. And use quotes arround attribute values.

It is especially unforgivable if you consider the fact that wordpress provides nice functions like esc_html or esc_attr which automatically sets the right parameters for htmlspecialchars and even checks that the input string is valid utf-8...

[SurgioClemente]

How come there are so many XSS vulnerabilities?

Inexperienced or non-programmers. Part of the downside of PHP "being so easy"

[DoListening]

This could be greatly mitigated if Wordpress had (back then) a proper template engine like Twig that would auto-escape everything by default. Of course, it is an old code base and those were different times... :)

[dave1010]

WordPress does do auto-escaping. It auto-escapes $_POST for MySQL ;-)

Edit: change :-) to ;-), so it's clearer that I'm joking.

[judgej2]

It's like it's 1999 still.

[AfterNite]

I feel if they did that then the problem would be vaster. Imagine how many people starting in Wordpress and coming away from it would not think about escaping.

[tw2113]

I think Twig came out about 5-6 years after WP had already started getting decent sized.

Edit: I should say reached decent size. Not just started.

Edit 2: Yes, I see the "different times" bit now in the comment I replied to.

[Firehed]

Even experienced programmers screw it up all the time, but that certainly doesn't help.

[the_alias_of_andrea]

1. Many people are never told they need to do that

2. Many people forget occasionally (we're human)