10up / wpcli-vulnerability-scanner

WP-CLI command for checking installed plugins and themes for vulnerabilities reported on wpvulndb.com
MIT License
274 stars 40 forks source link

Show error message in report when daily API rate limit is exceed, instead `No vulnerabilities reported`. #62

Closed rahulsprajapati closed 2 years ago

rahulsprajapati commented 2 years ago

Description of the Change

Show error message in report when daily API rate limit is exceed, instead No vulnerabilities reported.

Output of wp vuln status:

image

Alternate Designs

N/A

Benefits

Fix false positive report: currently we get No vulnerabilities reported for this version of <plugin/theme name> when api limit is exceed which gives user false information.

Possible Drawbacks

N/A

Verification Process

  1. Go to wpvulndb.com and create new account
  2. Install wp-vulnerability-scanner and set up fresh API key in wp-config
  3. Run wp-vulnerability-scanner on a site a until the free quota of 25 is full (1-3 times probably enough usually with a bigger site)
  4. Check wpvulndb.com account to see that the quota is indeed full
  5. Run call to wpvulndb.com API manually ex:
    curl -H "Authorization: Token token=API_TOKEN" https://wpvulndb.com/api/v3/wordpresses/494
  6. Observe that API answers: { "status": "rate limit hit" }
  7. Test wp vuln status once more and see that everything looks like its running pretty normally.
  8. Checkout this branch and run wp vuln status.
  9. You'll now see api limit error.

Checklist:

Applicable Issues

Closes #41

Changelog Entry

jeffpaul commented 2 years ago

@davidegreenwald @TheLastCicada pinging you both to see if you want/intend to review this as well or if we're good to merge in and continue towards a release?