Automattic / Automattic/wp-super-cache
Issue with caching searches and exploits
- Dominant language
- PHP
- Stars
- 436
- Forks
- 130
- Avg merge
- 15h 11m
- Merged PRs (30d)
- 10
Description
Hi there!
I've got (I think) an issue similar to Automattic/wp-super-cache#655–people are testing exploits in our search bar, which then get cached. This would be fine (assuming the exploits don't work), except our hosting service takes down the site every time a search with suspected malware is cached.
The file is `/home/tks/webapps/wpresdesign/wp-content/cache/meta/wp-cache-2fab3455e9ea525690ede99e18bbed32.php` and the contents of the file are:
`{"headers":{"Vary":"Vary: Cookie","Last-Modified":"Last-Modified: Sat, 30 Mar 2019 04:21:58 GMT","Content-Type":"Content-Type: text\/html; charset=\"UTF-8\""},"uri":"www.theknoxstudent.com\/\/?s=index\/\\think\\template\\driver\\file\/write&cacheFile=robots1.php&content=xbshell?php%20@eval$_POST[admin];?","blog_id":"1","post":0,"key":"www.theknoxstudent.com80\/\/?s=index\/\\think\\template\\driver\\file\/write&cacheFile=robots1.php&content=xbshell"}`
To prevent the plugin from caching searches, would I include 's=' in the list of pages to exclude from caching? Or is there some other way to remove searches from the cache?
We should be using the latest version of this plugin.
(Also please do let me know if my assumptions are wrong about what's going on in this file, I'm not super familiar with PHP.)
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by examining the reported cache metadata file and the search URI shown in the issue, then trace how the plugin handles search requests and its page-exclusion settings. Done means determining whether these searches are being cached and identifying a verified way to prevent the reported cache entries from taking down the site.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- backend, performance
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100