Add index.php stubs to block directory-listing exposure - #33
Open
miyanialkesh7 wants to merge 1 commit into
Open
Add index.php stubs to block directory-listing exposure#33miyanialkesh7 wants to merge 1 commit into
miyanialkesh7 wants to merge 1 commit into
Conversation
None of the plugin's directories had the standard WordPress index.php stub, so if the server ever serves directory listings (Options +Indexes, or a misconfigured host), the plugin's source tree structure and filenames are exposed. No functional or SQL/XSS vulnerabilities were found elsewhere in the codebase in this review: no superglobal access, no dangerous functions (eval, exec, unserialize, etc.), no raw $wpdb queries, and all dynamic output is already escaped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full security review of the plugin's PHP:
$_GET/$_POST/$_REQUEST/$_SERVER/$_COOKIE/$_FILES) anywhere in the codebase.eval,exec,system,shell_exec,unserialize,extract,create_function,base64_decode,assert) anywhere.$wpdbusage or raw SQL — nothing to parameterize.get_block_wrapper_attributes()/wp_interactivity_data_wp_context()false-positives are documented withphpcs:ignorein the PHPCS PR in this batch)..,Functions/,src/,src/blocks/, and each block folder) had the standard WordPressindex.phpstub, so a server that serves directory listings (Options +Indexes, or a misconfigured host) would expose the plugin's file structure. Added the standard stub to all 7 — new files only, no overlap with the other PRs in this batch.Test Plan
php -lpasses on all 7 new files