workflows

Author: PDowney

.github/workflows/wordpress-plugin-check.yml

@@ -592,34 +592,55 @@ jobs:
       - name: Security Check for known vulnerabilities in dependencies
         uses: symfonycorp/security-checker-action@v5
 
-      - name: WordPress Security Scan with WPScan
+      - name: WordPress Security Scan
         run: |
-          # Install WPScan
-          gem install wpscan
-          
-          # Create a temporary WordPress plugin structure for scanning
-          mkdir -p temp-wp/wp-content/plugins/simple-wp-optimizer
-          cp -r * temp-wp/wp-content/plugins/simple-wp-optimizer/ 2>/dev/null || true
-          
-          # Run WPScan on the plugin (scan for known vulnerabilities)
-          echo "Scanning for WordPress security vulnerabilities..."
-          wpscan --url file://$(pwd)/temp-wp --enumerate p --plugins-detection mixed --format json --output wpscan-results.json || true
-          
-          # Check if any vulnerabilities were found
-          if [ -f wpscan-results.json ]; then
-            echo "WPScan completed. Checking results..."
-            cat wpscan-results.json
-            
-            # Check for vulnerabilities in the JSON output
-            if grep -q '"vulnerabilities"' wpscan-results.json; then
-              echo "⚠️ Potential security vulnerabilities detected!"
-              exit 1
-            else
-              echo "✅ No known vulnerabilities detected."
-            fi
+          echo "Performing WordPress plugin security analysis..."
+          
+          # Basic security pattern checks for common WordPress vulnerabilities
+          echo "🔍 Checking for common security issues..."
+          
+          # Check for potential SQL injection patterns
+          if grep -r "mysql_query\|mysqli_query" --include="*.php" . 2>/dev/null; then
+            echo "⚠️ Warning: Direct database queries found - ensure proper sanitization"
+          fi
+          
+          # Check for potential XSS vulnerabilities (missing escaping)
+          if grep -r "echo \$_\|print \$_" --include="*.php" . 2>/dev/null; then
+            echo "⚠️ Warning: Potential XSS vulnerability - ensure output is escaped"
+          fi
+          
+          # Check for file inclusion vulnerabilities
+          if grep -r "include.*\$_\|require.*\$_" --include="*.php" . 2>/dev/null; then
+            echo "⚠️ Warning: Potential file inclusion vulnerability found"
+          fi
+          
+          # Check for eval() usage (security risk)
+          if grep -r "eval(" --include="*.php" . 2>/dev/null; then
+            echo "⚠️ Warning: eval() function usage detected - security risk"
+          fi
+          
+          # Check for proper nonce usage
+          if grep -r "wp_nonce_field\|wp_verify_nonce" --include="*.php" . >/dev/null 2>&1; then
+            echo "✅ WordPress nonce usage detected - good security practice"
+          else
+            echo "ℹ️ Info: Consider adding WordPress nonces for form security"
+          fi
+          
+          # Check for proper sanitization functions
+          if grep -r "sanitize_\|esc_" --include="*.php" . >/dev/null 2>&1; then
+            echo "✅ WordPress sanitization functions detected - good security practice"
           else
-            echo "✅ WPScan completed without detecting vulnerabilities."
+            echo "⚠️ Warning: Limited use of WordPress sanitization functions"
           fi
+          
+          # Check for capability checks
+          if grep -r "current_user_can\|user_can" --include="*.php" . >/dev/null 2>&1; then
+            echo "✅ WordPress capability checks detected - good security practice"
+          else
+            echo "ℹ️ Info: Consider adding user capability checks where appropriate"
+          fi
+          
+          echo "🛡️ WordPress security scan completed"
 
       - name: Create issue on security vulnerability
         if: ${{ failure() }}

phpstan.neon

@@ -6,18 +6,11 @@ parameters:
     paths:
         - simple-wp-optimizer.php
 
-    autoload_files:
+    bootstrapFiles:
         - vendor/php-stubs/wordpress-stubs/wordpress-stubs.php
 
     ignoreErrors:
         # Ignore WordPress global variables that might not be defined in test context
         - '#Variable \$wpdb might not be defined#'
         - '#Variable \$wp_query might not be defined#'
         - '#Variable \$post might not be defined#'
-    
-    bootstrapFiles:
-        - vendor/php-stubs/wordpress-stubs/wordpress-stubs.php
-    
-    wordpress:
-        # Enable WordPress-specific rules
-        constants_file: vendor/php-stubs/wordpress-stubs/wordpress-stubs.php