search

10up / wpcli-vulnerability-scanner

WP-CLI command for checking installed plugins and themes for vulnerabilities reported on wpvulndb.com
MIT License
274 stars 40 forks source link

Does not notify if API quota is filled for the day #41

Closed ehausen closed 2 years ago

ehausen commented 5 years ago

Describe the bug

Even if my API quota for wpvulndb.com is full for the day the vulnerability scanner just says no vulnerabilities found

Steps to Reproduce

  1. Go to wpvulndb.com and create new account
  2. Install wp-vulnerability-scanner and set up fresh API key in wp-config
  3. Run wp-vulnerability-scanner on a site a until the free quota of 50 is full (1-3 times probably enough usually with a bigger site)
  4. Check wpvulndb.com account to see that the quota is indeed full
  5. Run call to wpvulndb.com API manually ex: 
    curl -H "Authorization: Token token=API_TOKEN" https://wpvulndb.com/api/v3/wordpresses/494
  6. Observe that API answers: Retry Later
  7. Test wp vuln status once more and see that everything looks like its running pretty normally

Expected behavior

I would expect the tool to clearly state ERROR API QUOTA FULL or something

oscarssanchez commented 5 years ago

Sounds like a good improvement to the plugin. I'll bring to our standup. Thanks @ehausen

davidegreenwald commented 2 years ago

@jeffpaul @TheLastCicada Adding a +1 to this one—ran into it on some testing today and I believe it may be impacting the accuracy of our results on certain sites. When I did wp cache get to see the scanner's transient data, I saw a 429 error from the Cloudflare endpoint and an out of quota message. We would absolutely want this to generate an error message and exit code that can be captured in a script for alerting purposes instead of serving stale or wrong results.

jeffpaul commented 2 years ago

Noting that @TheLastCicada would also like to see the plugin:

handle API errors or other messages besides a status 200 reply more effectively