Add support for WPScan API scanning #273
Conversation
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 5 errors
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
wpcomvip-vipgoci-bot
dismissed stale reviews from themself
Dismissing review as all inline comments are obsolete by now
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
|
I wonder if the "VIP Code Analysis Bot" checks can be performed as a pre-push step to ensure it passes in the pipeline as well? |
I think that should be possible. Let's discuss during our next team meeting. |
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
wpcomvip-vipgoci-bot
dismissed
their stale review
Dismissing review as all inline comments are obsolete by now
There was a problem hiding this comment.
phpcs scanning turned up:
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
wpcomvip-vipgoci-bot
dismissed
their stale review
Dismissing review as all inline comments are obsolete by now
There was a problem hiding this comment.
phpcs scanning turned up:
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
wpscan-scan.php
Outdated
| $dir_with_problem_addons => $problem_addon_files | ||
| ) { | ||
| // Get array of file-names which are vulnerable/obsolete. | ||
| $problem_addon_file_names = array_keys( |
There was a problem hiding this comment.
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
wpcomvip-vipgoci-bot
dismissed
their stale review
Dismissing review as all inline comments are obsolete by now
There was a problem hiding this comment.
phpcs scanning turned up:
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approval DB enabled:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
wpcomvip-vipgoci-bot
dismissed
their stale review
Dismissing review as all inline comments are obsolete by now
|
@gudmdharalds the changes all look good, but do you know if the Markdown escaping is going to come through with a An asterisk in the middle of a sentence won't have any effect, but if it starts a line and is followed by a space, it would get turned into a bullet item, for example. I guess we can see how it works in practice and tweak it if needed. |
There was a problem hiding this comment.
phpcs scanning turned up:
🚫 1 error
This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.
Scan run detail
Software versions
Options file (
|
PHP lint optionsPHP lint files enabled:
Lint modified files only:
Directories not PHP linted:
SVG configurationSVG scanning enabled:
Auto-approval configurationAuto-approvals enabled:
Non-functional changes auto-approved:
Auto-approved file-types:
|
PHPCS configurationPHPCS scanning enabled:
PHPCS severity level:
Standard(s) used:
Runtime set:
Custom sniffs included:
Custom sniffs excluded:
Directories not PHPCS scanned:
|
| Author URI: http://ma.tt/ | ||
| */ | ||
|
|
||
| function test() { |
There was a problem hiding this comment.
🚫 Error( severity 5 ): You must use "/**" style comments for a function comment (Squiz.Commenting.FunctionComment.WrongStyle).
This patch will introduce WPScan API support to
vip-go-cias an optional feature. With the feature set up and enabled, new or altered plugins and themes submitted in pull requests will be scanned for security vulnerabilities using the WPScan API.TODO:
--wpscan-api).--wpscan-api-dry-mode).--wpscan-api-paths).--wpscan-api-skip-folders).--wpscan-api-url).--wpscan-api-token).vipgoci_run_init_options_wpscan().vipgoci_wpscan_find_addon_dirs_altered()).slugof plugins or themes altered and get additional data using functionality from WordPress Core (using logic inwp-core-misc.php), check for security problems via WPScan API (using logic implemented inwpscan-api.php), filter security problems that are not applicable (logic from same file). Make a distinction between vulnerable plugins and obsolete ones (vipgoci_wpscan_scan_dirs_altered()).vipgoci_wpscan_scan_save_for_submission())skip-wpscan-scan)7) and vulnerable ones (10).vipgoci_wpscan_scan_commit()).vipgoci_lint_report_comment_start())vipgoci_lint_report_comment_format_result())vipgoci_wpscan_report_start())vipgoci_report_submit_pr_generic_comment_from_results()vipgoci_wpscan_report_end()vipgoci_report_submit_pr_generic_comment_from_results()vipgoci_wpscan_report_format_cvss_score())vipgoci_wpscan_report_comment_format_result())vipgoci_report_submit_pr_generic_comment_from_results()vipgoci_wpscan_do_scan_via_api()vipgoci_wpscan_filter_fixed_vulnerabilities()vipgoci_wpcore_misc_get_file_wp_headers())vipgoci_wpcore_misc_get_file_wp_headers()vipgoci_wpcore_misc_cleanup_header_comment()).vipgoci_wpcore_misc_cleanup_header_comment()vipgoci_wpcore_misc_get_addon_headers_and_type()).vipgoci_wpcore_misc_get_addon_headers_and_type()vipgoci_wpcore_misc_scan_directory_for_addons())vipgoci_wpcore_misc_scan_directory_for_addons()UpdateURIheader found is outside of valid WordPress.org URIs, skip addon.vipgoci_wpcore_api_determine_slug_and_other_for_addons())vipgoci_wpcore_api_determine_slug_and_other_for_addons()vipgoci_wpcore_misc_assign_addon_fields()).vipgoci_wpcore_misc_get_addon_data_and_slugs_for_directory())vipgoci_wpcore_misc_get_addon_data_and_slugs_for_directory()vipgoci_http_api_fetch_url():vipgoci_http_api_post_url():Content-Typeheader.vipgoci_scandir_git_repo():vipgoci_preview_string(): Function to shorten strings, especially useful for logging API responses.vipgoci_preview_string()vipgoci_array_push_uniquely()Function add items to array, only if they are not in the array already.vipgoci_array_push_uniquely()vipgoci_directory_path_get_dir_and_include_base(): Function to get "base" path of target directory along with the directory-name itself, skip any sub-directories.vipgoci_directory_path_get_dir_and_include_base()vipgoci_github_files_affected_by_commit(): Function to get files affected by each pull request implicated by the commit.vipgoci_github_files_affected_by_commit().vipgoci_directory_found_in_file_list(): Function to check if a particular directory path is found in array of file paths.vipgoci_directory_found_in_file_list()vipgoci_string_found_in_substrings_array(): Check if any of the strings in a given array are a substring of comparison string.vipgoci_string_found_in_substrings_array()vipgoci_output_sanitize_url(): Function to escape URLs.vipgoci_output_markdown_escape(): Function to escape Markdown characters.--helpmessage.Scan run detailunit/tests/ReportCreateScanDetailsWpscanConfigurationTest.php)