WordPress / WordPress/WordPress-Coding-Standards
Add verification checks against $_SERVER header/env reads.
Open
Nobody has claimed this yet.
Status: Awaiting feedback
Status: Needs investigation
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Is your feature request related to a problem?
Following the widespread vulnerability of WooCommerce Payments, I tried testing the vulnerable code against WPCS -- but WPCS reported nothing.
if ( ! isset( $_SERVER['HTTP_X_WCPAY_PLATFORM_CHECKOUT_USER'] ) || ! is_numeric( $_SERVER['HTTP_X_WCPAY_PLATFORM_CHECKOUT_USER'] ) ) {
return null;
}
return (int) $_SERVER['HTTP_X_WCPAY_PLATFORM_CHECKOUT_USER'];
Describe the solution you'd like
I suggest adding a similar check that exists for $_POST: WordPress.Security.NonceVerification.Missing.
Additional context (optional)
- https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/
- I have a HackerOne report (ID 1906271) involving Automattic's software on this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the existing WordPress.Security.NonceVerification.Missing sniff with the $_SERVER access shown in the issue and review the linked WooCommerce Payments example. Determine the verification rule's scope for header and environment reads, then add the corresponding checks and tests demonstrating the expected findings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100