Automattic / Automattic/wp-super-cache

Issue with caching searches and exploits

Open
#888 2 comments 0 reactions 0 assignees View on GitHub
[Plugin] Super Cache bug
Dominant language
PHP
Stars
436
Forks
130
Avg merge
15h 11m
Merged PRs (30d)
10

Description

Hi there!
I've got (I think) an issue similar to Automattic/wp-super-cache#655–people are testing exploits in our search bar, which then get cached. This would be fine (assuming the exploits don't work), except our hosting service takes down the site every time a search with suspected malware is cached.

The file is `/home/tks/webapps/wpresdesign/wp-content/cache/meta/wp-cache-2fab3455e9ea525690ede99e18bbed32.php` and the contents of the file are:

`{"headers":{"Vary":"Vary: Cookie","Last-Modified":"Last-Modified: Sat, 30 Mar 2019 04:21:58 GMT","Content-Type":"Content-Type: text\/html; charset=\"UTF-8\""},"uri":"www.theknoxstudent.com\/\/?s=index\/\\think\\template\\driver\\file\/write&cacheFile=robots1.php&content=xbshell?php%20@eval$_POST[admin];?","blog_id":"1","post":0,"key":"www.theknoxstudent.com80\/\/?s=index\/\\think\\template\\driver\\file\/write&cacheFile=robots1.php&content=xbshell"}`

To prevent the plugin from caching searches, would I include 's=' in the list of pages to exclude from caching? Or is there some other way to remove searches from the cache?

We should be using the latest version of this plugin.

(Also please do let me know if my assumptions are wrong about what's going on in this file, I'm not super familiar with PHP.)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by examining the reported cache metadata file and the search URI shown in the issue, then trace how the plugin handles search requests and its page-exclusion settings. Done means determining whether these searches are being cached and identifying a verified way to prevent the reported cache entries from taking down the site.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
backend, performance
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.