Title: Catching Bad Code Before It Happens
Author: Ipstenu (Mika Epstein)
Published: January 26, 2016
Last modified: December 14, 2015

---

 [  ](https://profiles.wordpress.org/ipstenu/) [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/)
7:00 pm _on_ January 26, 2016     
Tags: bad code   

# Catching Bad Code Before It Happens

It’s not that easy.

We’ve got more spam/bad code in the pluginPlugin A plugin is a piece of software
containing a group of functions that can be added to a WordPress website. They can
extend functionality or add new features to your WordPress websites. WordPress plugins
are written in the PHP programming language and integrate seamlessly with WordPress.
These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
or can be cost-based plugin from a third-party. repository than anyone would like
to see, and while we do manually curate plugin submissions, we don’t actively or
even passively patrol all checkins for the bad stuff. We just can’t. We’re human,
and with 600-1000 check ins a day, we can’t keep up unless it was a full time job
and we were a Nacin-Bot.

While we have been adding on filters to plugins, to try and curtail the outright
bad stuff without needing human intervention, setting up filters and checks that
work more than 10% of the time has been a monumental effort. And frankly, 10% just
ain’t good enough. We still have to scan the whole repository for bad code on a 
semi-regular basis, and manually curate the naughty list. The pre-commit tool we
have there now checks for base64 and eval and other obvious stuff. It also can check
for non-obvious stuff, such as variable function calls (thanks to PHPPHP PHP (recursive
acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose
scripting language that is especially suited for web development and can be embedded
into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php)’
s tokenizer). Until we can get up to 80-90% reliability with those checks, there’s
no point in them, since the manual work remains intact.

And this is where you, the merry followers of this blog, come in. You’re smart people.
You know what bad code is. You know what hacks look like. You love regex and filters.
You scan plugins for the sheer fun of it (or because your work needs you to). We
want your help. We want your code.

How do you do it? What filters do you use, what strings do you look for, and what’s
your best trick to catching the bad guys?

I know you hate bad code as much as we do, and we won’t get to awesome without your
help!

[#bad-code](https://make.wordpress.org/plugins/tag/bad-code/)

### Share this:

 * [  Threads ](https://make.wordpress.org/plugins/2016/01/26/catching-bad-code-before-it-happens/?share=threads)
 * [  Mastodon ](https://make.wordpress.org/plugins/2016/01/26/catching-bad-code-before-it-happens/?share=mastodon)
 * [  Bluesky ](https://make.wordpress.org/plugins/2016/01/26/catching-bad-code-before-it-happens/?share=bluesky)
 * [  X ](https://make.wordpress.org/plugins/2016/01/26/catching-bad-code-before-it-happens/?share=x)
 * [  Facebook ](https://make.wordpress.org/plugins/2016/01/26/catching-bad-code-before-it-happens/?share=facebook)
 * [  LinkedIn ](https://make.wordpress.org/plugins/2016/01/26/catching-bad-code-before-it-happens/?share=linkedin)

 1.  ![](https://secure.gravatar.com/avatar/b518a5cf86a31ce1c2a64870b6e15a1e63e9827afc75f8fc12f7095d0cce7fb4?
     s=32&d=mm&r=g)
 2.   [Marko Heijnen](https://profiles.wordpress.org/markoheijnen/)  7:12 pm _on_ January
     26, 2016
 3.  At the community summit some of the hosts did talked about checking the quality
     of a pluginPlugin A plugin is a piece of software containing a group of functions
     that can be added to a WordPress website. They can extend functionality or add
     new features to your WordPress websites. WordPress plugins are written in the 
     PHP programming language and integrate seamlessly with WordPress. These can be
     free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
     or can be cost-based plugin from a third-party.. Mainly focussed if a plugin still
     works on a certain PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor)
     is a widely-used open source general-purpose scripting language that is especially
     suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php)
     version. It’s on my plate and I have played around a bit but nothing specific 
     yet. [http://php-grinder.com](http://php-grinder.com) is still a great project
     to look at but I guess not really the solution for this problem.
 4.  What I do wonder if the things what currently happens can be placed somewhere 
     publicly.
 5.  ![](https://secure.gravatar.com/avatar/7d4e6978df89809d15df65aac619677de2180d4e0ec5a613aece7c9e7103324d?
     s=32&d=mm&r=g)
 6.   [J.D. Grimes](https://profiles.wordpress.org/jdgrimes/)  8:04 pm _on_ January
     26, 2016
 7.  Before I use a pluginPlugin A plugin is a piece of software containing a group
     of functions that can be added to a WordPress website. They can extend functionality
     or add new features to your WordPress websites. WordPress plugins are written 
     in the PHP programming language and integrate seamlessly with WordPress. These
     can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
     or can be cost-based plugin from a third-party. I usually perform a manual review
     looking for security vulnerabilities. This is a manual review, but for my own 
     code I automate this process during development using [WPCS](https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/).
     The reason that I haven’t used WPCSWordPress Community Support A public benefit
     corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/)
     in 2016. when checking other code is that its security-related sniffssniff A module
     for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes
     code for a specific problem. Multiple stiffs are combined to create a PHPCS standard.
     The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell),
     similar to how a dog would "sniff" out food. are very strict. The XSS sniffsniff
     A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) 
     that analyzes code for a specific problem. Multiple stiffs are combined to create
     a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell),
     similar to how a dog would "sniff" out food. requires all output to be escaped
     right at the point of output for example—it can’t detect whether the variable 
     was escaped at some previous time. Early sanitization and late escaping are really
     practices that all developers should follow, but I realize it might not be realistic
     to expect those to ever become requirements for all plugins in the repo. Short
     of that, I’ve considered creating more restrictive versions of these sniffs, that
     will have many false negatives, but very few false positives. So everything that
     they would flag would have a very high (99% maybe) chance of being a real security
     vulnerability (XSS, SQLi, etc.). I think I might even have started work on some
     of these restricted sniffs. If you’re interested I can find the code. I’d be willing
     to help work on them if you think that this is something worth pursuing.
 8.  The other thing that I would suggest is that you might want to ban the use of 
     the `move_uploaded_file()` function. Usually when that function is used to upload
     a file in a plugin, it means that the plugin isn’t properly protecting against
     arbitrary file uploads. You should require that WordPress coreCore Core is the
     set of software required to run WordPress. The Core Development Team builds WordPress.’
     s `wp_handle_upload()` and `wp_handle_sideload()` be used instead, since these
     will automatically restrict the types of files that can be uploaded to a safe 
     list (though this can be disabled of `$overrides[‘test_type’]` is set to `false`).
 9.  ![](https://secure.gravatar.com/avatar/522dc9d037e4b0517ee9b76cd63d75a6331b0e578afa9b27fee84b02863ace80?
     s=32&d=mm&r=g)
 10.  [Varun Sridharan](https://profiles.wordpress.org/varunms/)  1:53 am _on_ January
     27, 2016
 11. Hi, All
      I just created a small php class which creates a welcome page and also
     fetch the data about this pluginPlugin A plugin is a piece of software containing
     a group of functions that can be added to a WordPress website. They can extend
     functionality or add new features to your WordPress websites. WordPress plugins
     are written in the PHP programming language and integrate seamlessly with WordPress.
     These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
     or can be cost-based plugin from a third-party. from wp.org. and this welcome 
     page loads only at the plugin activation..
 12. [https://github.com/technofreaky/WordPress_Plugin_Activation_Welcome_Page](https://github.com/technofreaky/WordPress_Plugin_Activation_Welcome_Page)
 13. Do you think its a bad code ??
      Need to modify more ?
 14. Or is there any other code / class available for plugin welcome screen
 15. ![](https://secure.gravatar.com/avatar/81a6c81f384c9d0bf3864240e1f5f197c6a3a1052c7cfc9e3e8fd977365cad4a?
     s=32&d=mm&r=g)
 16.  [SimonRWaters](https://profiles.wordpress.org/simonrwaters/)  9:28 am _on_ January
     27, 2016
 17. “How do we do it?” – we put all code through sonarqube, insecure dependency checking,
     various Java specific tools for Java detecting common bugs and measuring coverage,
     manual code review, and test with BurpSuite Pro and other tools at the security
     manager’s discretion (that’ll be me). It doesn’t scale, it doesn’t catch everything(
     nothing will). We are also solving a different problem (except when using 3rd 
     party plugins), we are looking for accidental mistakes, but you also have to look
     for deliberate spam, and that is a whole lot harder problem.
 18. Sonarqube is cool, but it isn’t terribly PHPPHP PHP (recursive acronym for PHP:
     Hypertext Preprocessor) is a widely-used open source general-purpose scripting
     language that is especially suited for web development and can be embedded into
     HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php)
     focused, might be a tool to add to the mix if you aren’t already, although they’ve
     tended just to re-use or re-implement existing PHP scanners. At least contribution
     to such a tool might find life and utility elsewhere.
 19. I’ve also made feedback that you accept contributions to SVNSVN Short for "SubVersioN",
     it's the code management system used to maintain the plugins hosted on WordPress.
     org. It's similar to git. without encrypting credentials, this seems a silly to
     me, just asking for credentials to be abused. My suggestions got the registration
     emails changed to suggest developers use TLS but I bet most just followed the 
     emailed instructions and still use unencrypted submissions. Do wonder if there
     are wider security issues that need addressing when I see that sort of thing.
 20. ![](https://secure.gravatar.com/avatar/ae9e5b95091b0d55a6fc185c6110f891afb0962cd7c4e8d48b1f8fb0302b54d0?
     s=32&d=mm&r=g)
 21.  [psiinon](https://profiles.wordpress.org/psiinon/)  10:47 am _on_ January 27,
     2016
 22. You could always use ZAP: [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)
     for dynamic security testing.
      ZAP can be used both manually and completely automated,
     eg as part of a CI environment. Its also open sourceOpen Source Open Source denotes
     software for which the original source code is made freely available and may be
     redistributed and modified. Open Source **must be** delivered via a licensing 
     model, see GPL. and completely free. Disclaimer – I’m the ZAP project lead 😉
 23. ![](https://secure.gravatar.com/avatar/e94f3356b975fa6aa2f731991d83f9a959b63a34e0eeca117415765f3a9e0e8c?
     s=32&d=mm&r=g)
 24.  [A WP Life](https://profiles.wordpress.org/awordpresslife/)  3:31 pm _on_ January
     28, 2016
 25. Hi Mika,
 26.  600-1000 check ins a day it so big figure to handle.
 27. But, I am really appreciate your work.
 28. You doing great job for all pluginPlugin A plugin is a piece of software containing
     a group of functions that can be added to a WordPress website. They can extend
     functionality or add new features to your WordPress websites. WordPress plugins
     are written in the PHP programming language and integrate seamlessly with WordPress.
     These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
     or can be cost-based plugin from a third-party. authors.
 29. Thanks
      aWPLife
 30. ![](https://secure.gravatar.com/avatar/b0c8446f2b606e8f61eb9122ed8b3296c09e45d647045d26a2b343d59c965838?
     s=32&d=mm&r=g)
 31.  [snowboardmommy](https://profiles.wordpress.org/snowboardmommy/)  9:14 pm _on_
     January 29, 2016
 32. I wonder if WordFence and/or the other security plugins could be called upon to
     help?
 33.  It’s in their best interest if spammy / infected stuff just doesn’t end up on
     anyone’s installation in the first place.
 34. I know that WordFence scans every pluginPlugin A plugin is a piece of software
     containing a group of functions that can be added to a WordPress website. They
     can extend functionality or add new features to your WordPress websites. WordPress
     plugins are written in the PHP programming language and integrate seamlessly with
     WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
     or can be cost-based plugin from a third-party. and theme on my wordpress installations,
     every day for me for hacks, infections … it also compares the files in the repository
     to make sure my local copy isn’t changed / infected. (For a while, it was driving
     me crazy with one of readme’s from Ban Hammer, actually!!)
 35. it seems like it should be possible to “reverse” the mirror and scan the repository
     itself for the same hacks, infections, etc. or, perhaps a “pre-repository” for
     not-yet-approved plugins.
 36. Anyway, if you don’t have their contact info, I can find it for you.
 37. HTH
 38. ~Bonnie
 39. ![](https://secure.gravatar.com/avatar/ba4fd2ff604515045077e7d4eb8250a0858f1d48d88a2a9dcef65e9667a34285?
     s=32&d=mm&r=g)
 40.  [palmermarc](https://profiles.wordpress.org/palmermarc/)  6:54 pm _on_ February
     2, 2016
 41. In your post, you mentioned not using variable functions. I have some validation
     functions that work as follows.
 42. $meta_fields = array(
      ‘field_1’ => ‘sanitize_text_field’, ‘field_2’ => ‘sanitize_html’,‘
     field_3’ => ‘custom_validation_sanitization_function’ );
 43. foreach( $meta_fields as $meta_key => $validation_function ) :
      update_post_meta(
     $post_id, $meta_key, call_user_func( $validation_function, $_POST[$meta_field]);
     endforeach;
 44. Is this the type of variable functions you’re actively working against? Or would
     this be considered okay?

Comments are closed.

# Post navigation

[← RESOLVED Same issues that were happening two weeks…](https://make.wordpress.org/plugins/2016/01/23/same-issues-that-were-happening-two-weeks-ago/)

[Plugin Review “Inconsistencies” →](https://make.wordpress.org/plugins/2016/02/03/plugin-review-inconsistencies/)