Hacker News Reader

Comment by RBr | Hacker News Reader

Wordpress themes aren't the only ones guilty of this. Shady plugins also contain hidden code.

http://www.themelab.com/2009/12/08/stop-downloading-wordpres...

TAC (Theme Authenticity Checker) isn't a bad place to start searching for malicious code: http://builtbackwards.com/projects/tac/

However, the only real solution to this problem is to run a limited set of extremely trustworthy plugins and build your own themes.

View on HN

> However, the only real solution to this problem is to run a limited set of extremely trustworthy plugins and build your own themes.

What on earth? It's pretty simple to check for malicious Javascript or PHP code in a theme.

What is your exhaustive definition of "malicious" in this case?

Let's see:

1) Anything linked outside of the domain. 2) Anything not HTML/CSS/image/Wordpress tag/Javascript libraries 3) Anything encrypted.

Let me know if I missed anything.

Do you whitelist the Javascript libraries? Who certifies them? Is having a base64 decode function available from the library a problem?

Do you scan the CSS for url() references outside of the domain?

1. Most Wordpress theme developers use popular Javascript libraries, so it wouldn't be too difficult to replace them with the original if you suspected something was amiss. The function wouldn't be a problem, if there wasn't any base64 code. 2. url() references should all be relative, in the same domain, so if it linked on the outside, I'd change it.

Most of the time I use a Wordpress theme as a starting point, rewriting some parts and looking over all of the code.

Also, mentioned above, securing the theme against injections and XSS is important.

Do you scan images provided with the theme to check if any subset or combination of subsets of their contents can be malicious when base64 decoded?

It is fairly simple to check for obviously malicious JS or PHP code in a theme, but it's not so easy to find themes which are badly written and thus insecure. Can you always spot a XSS or SQL injection vulnerability?

I wonder how many people who run WordPress think it's pretty simple to check for malicious Javascript or PHP code in a theme?

Reply on news.ycombinator.com