10up / wpcli-vulnerability-scanner

WP-CLI command for checking installed plugins and themes for vulnerabilities reported on wpvulndb.com
MIT License
278 stars 40 forks source link

Add Wordfence Intelligence CE as an API provider #78

Closed iamdharmesh closed 1 year ago

iamdharmesh commented 1 year ago

Description of the Change

PR adds support for Wordfence API to check reported vulnerabilities for WordPress core, installed plugins and themes.

Users can choose Wordfence API for vulnerabilities scan by adding the VULN_API_PROVIDER constant in wp-config.php

define( 'VULN_API_PROVIDER', 'wordfence' );

Apart from Wordfence Intelligence CE support, PR makes the below changes.

Closes #76

How to test the Change

  1. Add a VULN_API_PROVIDER constant in wp-config.php as below.
    define( 'VULN_API_PROVIDER', 'wordfence' );
  2. Try the given vuln commands in readme to scan for vulnerabilities.
  3. Make sure all commands are working fine.
  4. Regression: Make sure all commands are working fine with other services (WPScan and Patchstack)

Changelog Entry

Added - Wordfence Intelligence CE as an API provider.

Credits

Props @iamdharmesh @jeffpaul Charles Sweethill, Matt Barry (Wordfence Team)

Checklist:

iamdharmesh commented 1 year ago

Note: Functional tests for WPScan failing due to exceeding the Daily API limit.

jeffpaul commented 1 year ago

@iamdharmesh heads up on https://www.wordfence.com/intelligence-documentation/v2-accessing-and-consuming-the-vulnerability-data-feed/#changes, might require a tweak here before merge/release?

iamdharmesh commented 1 year ago

@iamdharmesh heads up on wordfence.com/intelligence-documentation/v2-accessing-and-consuming-the-vulnerability-data-feed/#changes, might require a tweak here before merge/release?

@jeffpaul We are not using the copyright field, So, our implementation will not affect by this.

jeffpaul commented 1 year ago

Note that I'm coordinating with the folks at Wordfence for a code review here as well, so let's hold before merging to give them a chance to provide input as well.

iamdharmesh commented 1 year ago

Update:

@jeffpaul I have made changes related to JSON parser here and I will work on other changes like adding the references column, renaming the fix column to Fixed in, adding show API provider information etc... next week.

jeffpaul commented 1 year ago

@iamdharmesh probably good to merge here and continue with the remainder of the 1.2.0 issues