Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Plugin Security
Search
Brad Parbs
July 26, 2014
Technology
3
100
Plugin Security
Brad Parbs
July 26, 2014
Tweet
Share
More Decks by Brad Parbs
See All by Brad Parbs
Learn to Love the Terminal
bradp
0
560
Extremely Powerful Local WordPress Development with Vagrant and Friends
bradp
1
140
Extremely Powerful Local WordPress Development with Vagrant and Friends - WordCamp Grand Rapids 2014
bradp
1
260
Web414 - Writing Clean, Clear, & Semantic Markup with HTML5
bradp
0
340
WordCamp Baltimore - Let's Get Sassy!
bradp
2
340
Starter Themes for Appleton WordPress Meetup
bradp
1
110
#WCGR - Getting SASSy
bradp
4
240
#WCPVD - Getting SASSy
bradp
2
240
WordCamp Chicago 2013 - Template Hiearchy
bradp
1
140
Other Decks in Technology
See All in Technology
The key to VCP-VCF
mirie_sd
0
160
シフトライトなテスト活動を適切に行うことで、無理な開発をせず、過剰にテストせず、顧客をビックリさせないプロダクトを作り上げているお話 #RSGT2025 / Shift Right
nihonbuson
3
1.7k
普通のエンジニアがLaravelコアチームメンバーになるまで
avosalmon
0
670
Alignment and Autonomy in Cybozu - 300人の開発組織でアラインメントと自律性を両立させるアジャイルな組織運営 / RSGT2025
ama_ch
1
1.9k
最近のSfM手法まとめ - COLMAP / GLOMAPを中心に -
kwchrk
8
1.8k
Visual StudioとかIDE関連小ネタ話
kosmosebi
1
300
React Routerで実現する型安全なSPAルーティング
sansantech
PRO
4
910
Accessibility Inspectorを活用した アプリのアクセシビリティ向上方法
hinakko
0
130
Unlearn Product Development - Unleashed Edition
lemiorhan
PRO
2
170
.NET 9 のパフォーマンス改善
nenonaninu
0
2.2k
2025年のARグラスの潮流
kotauchisunsun
0
670
スケールし続ける事業とサービスを支える組織とアーキテクチャの生き残り戦略 / The survival strategy for Money Forward’s engineering.
moneyforward
0
240
Featured
See All Featured
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
19
2.3k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
113
50k
Practical Tips for Bootstrapping Information Extraction Pipelines
honnibal
PRO
10
850
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
28
9.2k
YesSQL, Process and Tooling at Scale
rocio
170
14k
Visualization
eitanlees
146
15k
The Power of CSS Pseudo Elements
geoffreycrofte
74
5.4k
Measuring & Analyzing Core Web Vitals
bluesmoon
5
200
The MySQL Ecosystem @ GitHub 2015
samlambert
250
12k
A Philosophy of Restraint
colly
203
16k
VelocityConf: Rendering Performance Case Studies
addyosmani
327
24k
How to Ace a Technical Interview
jacobian
276
23k
Transcript
Security for Your Plugins
I’m Brad Parbs.
Nathan, you should watch Band of Brothers.
Let’s talk about what sucks in WordPress.
None
None
“20% of the 50 most popular WordPress plugins are vulnerable
to common Web attacks. This amounts to nearly 8 million downloads of vulnerable plugins.” Checkmarx, an application security company
Things that happen when your stuff isn’t secure.
None
How do we make sure this doesn’t happen?
Always develop with debugging ON
define( 'WP_DEBUG', true ); define( 'WP_DEBUG_DISPLAY', false );
define( 'WP_DEBUG_LOG', true ); define( 'SCRIPT_DEBUG', true ); define( 'WP_CACHE', false );
Sanitize all the things
intval(); absint();
wp_kses();
sanitize_title();
sanitize_email() sanitize_file_name() sanitize_html_class() sanitize_key() sanitize_meta()
sanitize_mime_type() sanitize_option() sanitize_sql_orderby() sanitize_post_field() sanitize_text_field() sanitize_title() sanitize_title_for_query() sanitize_title_with_dashes() sanitize_user()
Escape all the things
esc_html();
esc_textarea();
esc_attr();
esc_url();
http://codex.wordpress.org/Data_Validation
Database Queries
$wpdb-‐>insert();
$wpdb-‐>update();
$wpdb-‐>prepare();
Nonces
wp_nonce_url();
wp_nonce_field();
wp_create_nonce();
check_admin_referer();
wp_verify_nonce();
Remote Data
CURL is bad.
For real, CURL is bad.
wp_remote_get();
wp_remote_post();
wp_remote_request();
Check capabilities & roles
current_user_can();
Use native functions
A story about TimThumb
Questions?
None