Course - Introduction to plugin security

[jonathanbossenger]

Needs Assessment Statement

A short course to provide the new or intermediate developer knowledge on how to develop plugins securely, including an overview of common vulnerabilities, and how to prevent them

Target Audience

Courtney is a plugin developer who wants to ensure that her plugins do not expose any security vulnerabilities. She doesn't know where to find the relevant information, or what to look out for.

Course Objective

Beginner to intermediate WordPress plugin developers will learn about common security vulnerabilities, how they can be introduced, and what should be done to prevent them.

Outline #

• Developing for WordPress securely Introduction #1924
• Securely developing plugins and themes #1925
• Fixing common security vulnerabilities #1926
• Tools to detect security vulnerabilities #1927
• Beyond WordPress security - the OWASP top 10 #1928
• Conclusion #1929

Related Resources

Links to related content on Learn, HelpHub, DevHub, GitHub Gutenberg Issues, DevNotes, etc.

• WordPress Developer Plugin Handbook on Security
• Introduction to securely developing plugins
• Extending WordPress: common security vulnerabilities
• Most Common WordPress Vulnerabilities & How to Fix Them
• Plugin check plugin

Guidelines

Review the team guidelines

Course Development Checklist

• Needs Assessment Statement, Target Audience, Course Objective, and Outline created
• Needs Assessment Statement, Target Audience, Course Objective, and Outline vetted by an ID and feedback given
• Overall topic and Outline Vetted by a Subject Matter Expert and feedback given
• Gather links to Support and Developer Docs
• Review any related material on Learn
• Course created and announced to the team for Q/A review
• Course review completed and ready to publish
• Course excerpt created and featured on Learn WordPress
• Course announced to Marketing Team for promotion

[smileBeda]

I am adding the rest of the topics here as I could not find more particular place (added one in a sub-ticket)

---

Another topic that usually gets forgotten completely is JS safety.
Things like these for example.
https://www.bleepingcomputer.com/news/security/invisible-characters-could-be-hiding-backdoors-in-your-javascript-code/
https://certitude.consulting/blog/en/invisible-backdoor/#:~:text=A%20few%20months%20ago%20we,even%20from%20thorough%20code%20reviews

Some other resources in regard of JS security.
https://gomakethings.com/how-to-reduce-your-risk-of-cross-site-scripting-attacks-with-vanilla-javascript/
https://gomakethings.com/injecting-text-instead-of-html-with-vanilla-js-to-reduce-your-risk-of-xss-attacks/
https://gomakethings.com/how-to-encode-strings-with-vanilla-js-to-reduce-the-risk-of-xss-attacks/
https://gomakethings.com/how-to-sanitize-html-strings-with-vanilla-js-to-reduce-your-risk-of-xss-attacks/

---

A often overseen detail is localisation - while the DOC meanwhile does get that part right, often it still causes confusion:
https://developer.wordpress.org/plugins/internationalization/security/#use-placeholders-for-urls

---

Another topic that IMO is part of "safe and secure" is code documentation and code style.
A code that is not documented, or badly documented, and/or does not follow at least some (bette: the WPCS) styling (Not speaking of security standards here) is very likely to be bad/vulnerable code.
Having Doc and guidelines/standards means the developer spent time thinking about his/her code and reflected over it. Having code that is just a bunch of - no matter how awesome and poetical - lines of code often means it is a pure copy paste or done in a hurry without the necessary "love". This part is a highly opinionated subject... so I guess it might be too hot to touch :)

I personally use PHPDocumentor and, of curse, WordPress WPCS standard.
The Documentor is worth gold: too often you will realise after creating a doc that ... oh darn that method actually states to return string but returns array. And so on.

[jonathanbossenger]

The content for this course matches the module on developing securely in the Beginner Developer Learning Pathway, therefore this course has been "merged" into that pathway.