Skip to content

Commit

Permalink
Change role with capabilities, update text and packages
Browse files Browse the repository at this point in the history
  • Loading branch information
@samiahmedsiddiqui
samiahmedsiddiqui committed Dec 23, 2024
1 parent b7362fa commit 1bfa90f
Show file tree
Hide file tree
Showing 11 changed files with 5,117 additions and 9,987 deletions.
66 changes: 16 additions & 50 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -1,28 +1,13 @@
# Prevent XSS Vulnerability

This plugin provides the functionality for `Reflected XSS` and `Self-XSS` in
`WordPress`.
This WordPress plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:

For Reflected XSS, it checks the URL and redirects it if you enabled the `Enable Blocking`
option and URL contains any Vulnerable code in it. It only block some parameters which are
not allowed in URL and shown [here](#block-parameters). You can skip some of the
parameters from it if you still like them to be used.
- **Reflected XSS:** In Reflected XSS, malicious scripts are injected into the URL of a website. When a user clicks on a link containing this malicious script, it can be executed on their browser, potentially stealing their information or compromising their system.
- **Self-XSS:** This occurs when a user's own input on the website is reflected back to them in an insecure manner, allowing malicious scripts to be executed in their browser.

To provide more security, this plugin also escape the HTML in the `$_GET`
parameter which is commonly used to get parameters in PHP from the URL and
print them in the HTML. This way, HTML properties will not work if anyone
provided it in the URL.
This plugin provides several layers of protection:

There are many ways by which the plugin can be tested but it may varies for
different sites according to their structure and development functionality.

If you like to get help or have any query then please feel free to reach me at
[[email protected]](mailto:[email protected]).

## Block Parameters

This plugin block the following parameters in the URL if enabled from the
Plugin Settings.
**Blocking:** When enabled, the plugin scans URLs for specific parameters. If any of the listed parameters are found in the URL, the plugin redirects the user to prevent potential XSS attacks. You can customize the list by excluding specific parameters you still want to allow.

| Symbol | Name |
|:------:|:----------------------:|
Expand All @@ -35,13 +20,7 @@ Plugin Settings.
| \| | Pipe or Vertical Bar |
| `}` | Closing Curly Bracket |

> :information_source: You can exclude any of the pre-defined parameter(s) or
> include any other parameter(s) from the Plugin Settings page.
## Encode Parameters

This plugin encode the following parameters in the URL if enabled from the
Plugin Settings.
**Encoding:** For additional security, the plugin encodes certain characters within the URL parameters. This prevents malicious code from being executed even if it's included in the URL. You can also exclude specific parameters from being encoded.

| Symbol | Name |
|:------:|:----------------------:|
Expand All @@ -61,25 +40,14 @@ Plugin Settings.
| \| | Pipe or Vertical Bar |
| `}` | Closing Curly Bracket |

> :information_source: You can exclude any of the pre-defined parameter(s) to
> being encoded from the Plugin Settings page.
## Escape HTML in `$_GET` Variable

This plugin escape HTML in `$_GET` variable. `$_GET` variable is mostly used
to put the values in HTML from the URL. This Check is quite useful if your site
using/getting anything from the URL and printing it in HTML. It secures your
Search and other sections as per your site functionality.
**Escaping HTML in `$_GET`:** This plugin automatically escapes HTML characters within the `$_GET` variable. This is crucial if your website retrieves data from URLs and displays it in the HTML content. This helps prevent malicious scripts from being injected through user-controlled input.

> :information_source: Make sure to check your forms after activating the plugin and if you
> have woocommerce site then please also check the cart and checkout process.
### Important Notes:

## Bug reports
* After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Ensure the plugin doesn't disrupt your cart and checkout processes.
* Bug reports for this plugin are welcome on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please note that GitHub is not a support forum, and only genuine bug reports will be addressed.

Bug reports for Prevent XSS Vulnerability are
[welcomed on GitHub](https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues).
Please note GitHub is not a support forum, and issues that aren't properly qualified as bugs
will be closed.
By implementing this plugin and following the recommendations, you can significantly enhance your website's security against XSS attacks.

## Installation

Expand All @@ -101,22 +69,20 @@ or Manually from FTP.

### After activation

1. Navigate to the `Prevent XSS Vulnerability` page from the Admin Dashboard
1. Navigate to the `Prevent XSS Vulnerability` page from the Admin Dashboard
2. Make the changes as per your site functionality
3. You're done!

## Frequently Asked Questions

**Q. Why should I install this plugin?**

A. Installing this plugin is the easiest way to protect your site from XSS Vulnerability.
A. Installing this plugin is the easiest way to protect your site from XSS Vulnerabilities.

**Q. Does this plugin escape HTML in printing search?**

A. Yes, this plugin escape HTML in `$_GET` variable which is mostly use to print the data
from the URL to HTML. If your site is using `$_GET` then it is safe and the HTML will be
escaped otherwise you need to check.
A. Yes, this plugin escapes HTML in `$_GET` variable, which is commonly used to print data from the URL to HTML. However, if your site relies heavily on `$_GET` for other purposes, you may need to conduct thorough testing to ensure compatibility.

**Q. Does this plugin has any conflict with any other plugin?**
**Q. Does this plugin have any conflict with any other plugin?**

A. No, this plugin doesn't have any conflict with any plugin until now.
A. While no major conflicts have been reported, it's always a good practice to test your website thoroughly after installing any new plugin.
8 changes: 4 additions & 4 deletions admin/class-prevent-xss-vulnerability-admin.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ public function admin_menu() {
add_menu_page(
'Prevent XSS Vulnerability',
'Prevent XSS Vulnerability',
'administrator',
'activate_plugins',
'prevent-xss-vulnerability-reflected-settings',
array( $this, 'reflected_settings' ),
'dashicons-shield'
Expand All @@ -48,23 +48,23 @@ public function admin_menu() {
'prevent-xss-vulnerability-reflected-settings',
'Reflected Cross-site scripting Settings',
'Reflected XSS',
'administrator',
'activate_plugins',
'prevent-xss-vulnerability-reflected-settings',
array( $this, 'reflected_settings' )
);
$self_page = add_submenu_page(
'prevent-xss-vulnerability-reflected-settings',
'Self Cross-site scripting Settings',
'Self-XSS',
'administrator',
'activate_plugins',
'prevent-xss-vulnerability-self-settings',
array( $this, 'self_xss_settings' )
);
$about_page = add_submenu_page(
'prevent-xss-vulnerability-reflected-settings',
'About Cross-site scripting',
'About',
'administrator',
'activate_plugins',
'prevent-xss-vulnerability-about',
array( $this, 'about_xss' )
);
Expand Down
31 changes: 17 additions & 14 deletions admin/class-prevent-xss-vulnerability-reflected-settings.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ private function get_block_output( $excluded_entities, $include_entities, $enabl
<p>
<?php
esc_html_e(
'This Plugin Block/Remove the following Entities in the URL:',
'This plugin blocks or removes the following entities from website URLs:',
'prevent-xss-vulnerability'
);
?>
Expand Down Expand Up @@ -148,7 +148,7 @@ private function get_encode_output( $excluded_entities, $enabled ) {
<p>
<?php
esc_html_e(
'This Plugin Encodes the following Entities in the URL: ',
'This plugin encodes the following entities within website URLs:',
'prevent-xss-vulnerability'
);
?>
Expand Down Expand Up @@ -304,8 +304,6 @@ private function get_encode_output( $excluded_entities, $enabled ) {
* @since 1.0.0
*
* @param string $enabled Whether the escape is enabled or not.
*
* @return void
*/
private function get_escape_output( $enabled ) {
?>
Expand All @@ -319,7 +317,16 @@ private function get_escape_output( $enabled ) {
<p>
<?php
esc_html_e(
'It strips the HTML in $_GET variable in PHP. So, where ever the $_GET is used in either theme or plugin will get the escaped HTML. It prevents the XSS Attack using HTML and JS Events. If any plugin directly fetching the parameters from the URL without using $_GET variable will get the values without HTML escaped.',
'This plugin strips HTML tags from the $_GET variable in PHP. Consequently, any part of your theme or plugin that utilizes $_GET to retrieve data from the URL will receive the HTML-escaped value. This effectively prevents XSS attacks that exploit HTML and JavaScript events.',
'prevent-xss-vulnerability'
);
?>
</p>

<p>
<?php
esc_html_e(
'Important Note: If any plugin or custom code directly fetches URL parameters without using the $_GET variable, the retrieved values will not be HTML-escaped by this plugin.',
'prevent-xss-vulnerability'
);
?>
Expand All @@ -342,7 +349,7 @@ private function get_escape_output( $enabled ) {
}

/**
* Generate Refleccted page note HTML
* Generate Reflected page note HTML.
*
* @access private
* @since 1.0.0
Expand All @@ -353,7 +360,7 @@ private function get_reflected_desc() {
<p>
<?php
esc_html_e(
'Reflected Cross-site Scripting (XSS) occur when an attacker injects browser executable code within a single HTTP response. You can read more about XSS from',
'Reflected XSS occurs when malicious code is injected into a website\'s URL. This code can then be executed by a user\'s browser, potentially stealing information or compromising their system. For more information on XSS, please visit',
'prevent-xss-vulnerability'
);
?>
Expand All @@ -370,15 +377,15 @@ private function get_reflected_desc() {
<p>
<?php
esc_html_e(
'After configuring the settings please check some pages randomly to verify that your site is working as expected.',
'After configuring these settings, please thoroughly test your website by randomly navigating through different pages to ensure all functionalities are working as expected.',
'prevent-xss-vulnerability'
);
?>
</p>
<p>
<?php
esc_html_e(
'If you are using WooCommerce, then in that case it is highly recommended to go through with all the steps of the Product Purchase (Cart, Checkout etc) to make sure that your online store is working fine.',
'If you are using WooCommerce, it is crucial to test the entire product purchase process, including cart, checkout, and order completion, to verify that the plugin does not interfere with any core functionalities of your online store.',
'prevent-xss-vulnerability'
);
?>
Expand All @@ -395,8 +402,6 @@ private function get_reflected_desc() {
*
* @access private
* @since 1.0.0
*
* @return void
*/
private function save_reflected_settings() {
$form_submit = filter_input( INPUT_POST, 'submit' );
Expand Down Expand Up @@ -468,8 +473,6 @@ private function save_reflected_settings() {
*
* @access private
* @since 0.1
*
* @return void
*/
private function xss_reflected_settings() {
$this->save_reflected_settings();
Expand Down Expand Up @@ -522,7 +525,7 @@ private function xss_reflected_settings() {
<div class="wrap">
<h2>
<?php
esc_html_e( 'Reflected Cross-site scripting(XSS) Settings', 'prevent-xss-vulnerability' );
esc_html_e( 'Reflected Cross-site Scripting (XSS) Settings', 'prevent-xss-vulnerability' );
?>
</h2>

Expand Down
50 changes: 36 additions & 14 deletions admin/class-prevent-xss-vulnerability-self-settings.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,6 @@ public function __construct() {
*
* @access private
* @since 1.0.0
*
* @return void
*/
private function save_self_xss_settings() {
$form_submit = filter_input( INPUT_POST, 'submit' );
Expand Down Expand Up @@ -58,11 +56,9 @@ private function save_self_xss_settings() {
*
* @access private
* @since 0.3.0
*
* @return void
*/
private function self_xss_settings_page() {
if ( ! current_user_can( 'administrator' ) ) {
if ( ! current_user_can( 'activate_plugins' ) ) {
wp_die(
esc_html_e(
'You do not have sufficient permissions to access this page.',
Expand Down Expand Up @@ -97,16 +93,42 @@ private function self_xss_settings_page() {

<div class="wrap">
<h2>
<?php
esc_html_e( 'Self-XSS Settings', 'prevent-xss-vulnerability' );
?>
<?php esc_html_e( 'Self-XSS Settings', 'prevent-xss-vulnerability' ); ?>
</h2>
<div>
<p>
<?php
esc_html_e( 'Self-XSS is a social engineering attack used to gain control of victims\' web accounts. In a self-XSS attack, the victim of the attack unknowingly runs malicious code in their own web browser, thus exposing it to the attacker.', 'prevent-xss-vulnerability' );
?>
</p>
<p>
<?php
esc_html_e( 'Self-XSS is a type of security vulnerability where an attacker tricks a user into executing malicious code within their own web browser. This can occur through social engineering tactics, such as convincing the user to copy and paste malicious code into their browser\'s console.', 'prevent-xss-vulnerability' );
?>
</p>
<p>
<?php
esc_html_e( 'Here\'s a breakdown of how it works:', 'prevent-xss-vulnerability' );
?>
</p>
<ol>
<li>
<?php
esc_html_e( 'Social Engineering: The attacker employs social engineering techniques (e.g., phishing, promises of rewards) to convince the victim to perform a specific action.', 'prevent-xss-vulnerability' );
?>
</li>
<li>
<?php
esc_html_e( 'Code Execution: The victim is tricked into executing the malicious code, often by pasting it into the browser\'s console or through other means.', 'prevent-xss-vulnerability' );
?>
</li>
<li>
<?php
esc_html_e( 'Compromised Browser: Once executed, the malicious code can potentially steal sensitive information, hijack user sessions, or spread malware.', 'prevent-xss-vulnerability' );
?>
</li>
</ol>

<p>
<?php
esc_html_e( 'Self-XSS attacks exploit user trust and curiosity. It\'s crucial for users to be vigilant and avoid executing any code they don\'t fully understand or trust.', 'prevent-xss-vulnerability' );
?>
</p>
</div>
<form enctype="multipart/form-data" action="" method="POST" id="reflected-xss">
<?php
Expand All @@ -130,7 +152,7 @@ private function self_xss_settings_page() {
<small>
<?php
esc_html_e(
'Add warning message when users open the web developer console. Leave empty to use default.',
'Customize the warning message that appears in the console. Leave empty to use the default message.',
'prevent-xss-vulnerability'
);
?>
Expand Down
Loading

0 comments on commit 1bfa90f

Please sign in to comment.