mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-10 05:53:05 +09:00
Juan DenisandClaude Opus 4.8
2b5db90f89
Cross-reference a site's installed plugin/theme/core slug+version against the keyless community WPVulnerability API and surface findings per site. WpVulnerabilityService reads installed versions via the Docker-aware WP-CLI bridge (wp core version + get_plugins/get_themes directly — not the host-filesystem-gated get_wordpress_info, which fails for volume-backed Docker sites), queries https://www.wpvulnerability.net/{plugin,theme,core}/ (no key, 1h in-memory cache, descriptive UA, 8s timeout), matches the installed version against each advisory operator bounds (core advisories all apply — the feed is version-scoped), and extracts CVE id / severity (cvss3 -> cvss short-code -> score) / fixed-in / reference. Persisted as a new WordPressVulnerability child model (FK -> wordpress_sites.id) + a last_vuln_scan_at column (Alembic 011, idempotent). The scan runs in a background thread (Lynis-style) so the single worker never blocks; a new Vulnerabilities tab polls for status and renders findings with severity badges, CVE links, and a summary. On-demand only. Security (3-lens review): reference_url restricted to http(s) (blocks javascript: hrefs); feed slug percent-encoded; unrecognized version operator skips rather than over-flags; the major Docker volume-backed core-read gating was fixed so normal sites scan. Verified: backend py_compile, frontend lint + build. Not runtime-exercised on a real host. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>