Writing Secure Plugins — WordCamp New York 2009

Writing Secure
Plugins

Mark Jaquith

@markjaquith
markjaquith.com
coveredwebservices.com

Saturday, November 14, 2009

XSS privilege

shell execution
escalation

CSRF
SQL injection

Plugin
security is
hit-or-miss

Mostly
miss

SQL
Injection

<?php
$wpdb->query(
"UPDATE $wpdb->posts
SET post_title = '$newtitle'
WHERE ID = $my_id"
);
?>


<?php
$newtitle =
esc_sql( $newtitle );
$my_id = absint( $my_id );

$wpdb->query(
"UPDATE $wpdb->posts
SET post_title = '$newtitle'
WHERE ID = $my_id"
);
?>


$wpdb->update()


<?php
$wpdb->update(
$wpdb->posts,
array( 'post_title' => $newtitle ),
array( 'ID' => $my_id )
);
?>


$wpdb->insert()


<?php
$wpdb->insert(
$wpdb->posts,
array( 'post_title' => $newtitle )
);
?>


<?php
$wpdb->update(
$wpdb->posts,
array(
'post_title' => $newtitle,
'post_content' => $newcontent ),
array(
'ID' => $my_id,
'post_title' => $old_title )
);
?>


<?php
$post_title = 'New Title';
$wheres['ID'] = 123;
$wheres['post_title'] = 'Old Title';
$wpdb->update(
$wpdb->posts,
compact( 'post_title' ),
$wheres
);
?>


$wpdb->prepare()


<?php
$title = 'Post Title';
$ID = 123;
$content = $wpdb->get_var(
$wpdb->prepare(
"SELECT post_content
FROM $wpdb->posts
WHERE post_title = %s
AND ID = %d",
$title, $ID )
);
?>

•Uses sprintf() formatting
•%s for strings
•%d for integers
•You should not quote or
escape


Escape
late

XSS

<?php
$title = '<script> pwnage(); </script>'
?>

<h1>
<?php
echo $title;
?>
</h1>


Anything that
isn’t hardcoded
is suspect

Better:
Everything is suspect


esc_html()


<?php
$title =
'<script> pwnage(); </script>'
?>
<h1>
<?php
echo esc_html( $title );
?>
</h1>


<?php
$title = '" onmouseover="pwnd();';
?>
<a href="#wordcamp" title="
<?php
echo $title;
?>
">
Link Text
</a>


esc_attr()


<?php
$title = '" onmouseover="pwnd();';
?>
<a href="#wordcamp" title="
<?php
echo esc_attr( $title );
?>
">
Link Text
</a>


<?php
$url = 'javascript:pwnage();';
?>
<a href="
<?php
echo esc_attr( $url );
?>
">
WRONG
Link Text
</a>


esc_url()


<?php
$url = 'javascript:pwnage();';
?>
<a href="
<?php
echo esc_url( $url );
?>
">
Link Text
</a>


esc_url_raw(),
sister of esc_url()


esc_ js()


CSRF

Authorization
vs.

Intention

Nonces
action-, object-,
user-speciﬁc time
limited secret keys

Speciﬁc to
•WordPress user
•Action attempted
•Object of attempted action
•Time window

wp_nonce_ﬁeld()


check_admin_referer( )


<?php
// before output goes to browser
check_admin_referer('plugin-
action_object');
?>


Still need to use
current_user_can()


AJAX
CSRF

• wp_create_nonce( 'your_action' );

• &_ajax_nonce=YOUR_NONCE
• check_ajax_referer( 'your_action' );


Privilege
Escalation

current_user_can()


Set your salts!
http://api.wordpress.org/secret-key/1.1/


Stupid shit
I see all
the time

exec()


<a href="<?php echo $url; ?>"
title="<?php echo $title; ?>">
<?php echo $text; ?>
</a>

<script>
var foo = '<?php echo $js; ?>';
</script>


<a href="<?php echo esc_url( $url ); ?>"
title="<?php echo esc_attr( $title ); ?>">
<?php echo esc_html( $text ); ?>
</a>

<script>
var foo = '<?php echo esc_js( $js ); ?>';
</script>


Discussion


Writing Secure Plugins — WordCamp New York 2009

More Related Content

What's hot (20)

Similar to Writing Secure Plugins — WordCamp New York 2009 (20)

More from Mark Jaquith (12)

Recently uploaded (20)

Writing Secure Plugins — WordCamp New York 2009