wp-taint-scan - Go static taint-analysis engine that finds vulnera

项目说明

<di="center">

<img src="docs/banner.png" alt="wp-taint-scan" width="780">

<p><b>Find real in WordPress plugins.</b> Search the plugin directory, scan any — or every — in parallel, and diff findings across releases. A native Go taint-analysis engine that understands the <i>WordPress security model</i>, not just generic source→sink flow.</p>

![Go]()
![CI]()
![PRs welcome]()
!Dependencies

Quick start · Web UI · How it works · HTTP API

_{⭐ If this is useful, a star helps others find it.}

</div>

---

Screenshots

| | |
|:--:|:--:|
| Search the WordPress.org directory | Pick a , or scan them all |
|  |  |
| Parallel scan dashboard (live) | Findings + source→sink dataflow trace |
|  |  |

diff — see exactly which findings were *introduced* or *fixed* between two releases:


> The analysis engine ships as a CLI (taint-scan, installed as phparser) and a web app (taint-web). No PHP runtime, no Semgrep, no external services — just Go.

Why it's different

Generic taint scanners drown in false positives on WordPress code because they don't model how WordPress actually gates access. This engine encodes the real rules that decide whether a finding is exploitable:

classes detected

Analysis runs as independent sink-op batches (delete, read, open, include, write, output, sql, action, call) so each detector has its own relevance/scoring and one detector can't perturb another's results.

Install

Pick whichever is easiest — no Go toolchain needed for the first three.

1. One-line installer (Linux / macOS, downloads the prebuilt binary):

2. Download a prebuilt binary for your OS/arch from the
Releases page
(Linux/macOS .tar.gz, Windows .zip — each contains taint-web + taint-scan), unpack, and run.

3. Docker:

4. With Go (1.25+):

5. From source:

Then start the web UI and open <

Usage

Each scan writes:

| File | Contents |
|---|---|
| taint-results.json | Machine-readable findings (rule id, message, source→sink trace, access tier). |
| human-summary.md | Findings ranked by exploitability (unauth/low-pri). |
| README.md | Run metadata. |

Web UI

taint-web is a self-contained web app for disco and scanning plugins straight from the WordPress.org directory — search by name, browse every released , and scan one or a whole batch in parallel.

What it gives you:

Isolation & safety

Every scan runs in a separate child process (taint-web -scan-worker …) — the same binary re-invokes itself — with a soft heap ceiling (-mem-limit-mb), a hard RSS watchdog (-hard-cap-mb, kills + marks the job *skipped*), and a wall-clock -timeout. A pathological mega-plugin therefore can never OOM or crash the server; only its own worker dies. Downloads are size-capped, zip extraction is zip-slip-safe with uncompressed-size/file-count limits, and all plugin/ inputs are strictly before they touch a URL or a filesystem path. The server only e to the hardcoded api.wordpress.org / downloads.wordpress.org hosts (no SSRF), and the UI renders all untrusted plugin data as text (no HTML injection from malicious plugin code in snippets).

HTTP API

| Endpoint | Purpose |
|---|---|
| GET /api/search?q= | search plugins by name |
| GET /api/plugin?slug= | plugin info + sorted + which are already scanned |
| POST /api/scan | {slug, name, [], mode:"selected\|latest\|all", force} → enqueue jobs |
| GET /api/jobs[?batch=] | list jobs (optionally one batch) |
| GET /api/job?id= | one job with findings |
| GET /api/job/export?id=&format=json\|md | download a report |
| POST /api/cancel?id= | cancel a queued/running job |
| GET /api/diff?slug=&a=&b= | finding delta between two scanned |
| GET /api/stats | aggregate counters |
| GET /api/events | Ser Events stream of job updates |

Mass-scanning safely (memory)

The engine's peak held memory is small (~0.2–0.7 GB on normal plugins), but a handful of
mega-plugins (WooCommerce/Elementor-scale) can trigger a transient interprocedural-instantiation
allocation burst that outpaces the garbage collector. **Go cannot abort an allocation
mid-flight**, so -mem-limit-mb reduces — but cannot *guarantee* — no OOM.

For scanning a whole plugin tree, use the watchdog as the outer loop:

scan-capped.sh runs the scan under a hard RSS ceiling and kills + skips a pathological
plugin instead of crashing the host. See docs/EFFECTI.md
and docs/OPTIMIZATION_PLAN.md for the full memory analysis.

The engine is against a 72-case real-C (57 with locally reproduced
plugin fixtures). The comparison harness lives in test/semgrep_bundle_corpus/:

The committed corpus.json is the manifest of CVEs and expected findings; the plugin
fixtures (~685 MB) are fetched on demand. Unit/regression tests:

Repository layout

Dependency

Built on php-parser-go (a native Go port of nikic/PHP-Parser) for PHP parsing/AST — pulled in as a module, no other third-party dependencies. To hack on both repos at once, side-by-side:

Contributing

Issues and PRs welcome. go build ./..., go test ./..., and go vet should pass; CI runs build + vet + race tests on every PR. No plugin-specific or C logic in the engine — detectors must be generic.

License

MIT © Dimas Maulana (dimasma0305). The bundled php-parser-go derives from nikic/PHP-Parser (BSD-3-Clause).

> Intended for authorized security testing, CTF, and defensi — scan plugins you own or are permitted to test.

项目信息

开发语言：Go

Star 数：21

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX entrypoints). Detects SQLi, XSS, IDOR, privesc, RCE. Built on php-parser-go.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。