CSS Customizer control field - vulnerabilty against hacks prevention

[marcorinia]

Enhancement WP Core idea:

In the standard WP - Customizer - CSS control field is possible to add custom: CSS, JavaScript and also PHP code. This feature is great but also dangerous for like database injection scripts for hacking sites.

Is it possible to make this CSS control field more secure to prevent executing of hack scripts at some way? Maybe with some regular expressions or with realtime validations code of the input before saving and updating the input code.

[marcorinia]

screenshot script code add in CSS control

[audrasjb]

Hi @marcorinia and welcome to WordPress Trac,

Custom CSS inputs are already tested, you should not be able to use JS scripts in this field and PHP snippets aren’t executed.

Also, please note that security issues should be reported on WordPress security program, not on WordPress Trac (there was a message about that when you submitted your ticket).

[marcorinia]

Replying to audrasjb:

Hi @marcorinia and welcome to WordPress Trac,

Custom CSS inputs are already tested, you should not be able to use JS scripts in this field and PHP snippets aren’t executed.

Also, please note that security issues should be reported on WordPress security program, not on WordPress Trac (there was a message about that when you submitted your ticket).

Hi @audrasjb ,

Thank you for responding very fast and youre clear explaination.

I didn't understand where and how to submit a ticket at the WP security program. That's why i submitted it here. Sorry for that.

Greetings,

Marco

[marcorinia]

Maybe has @ramonfincken some extra additions/improvements for more security to add to this security aspect about the CSS standard field in the Customizer?

[ramon fincken]

Replying to marcorinia:

Maybe has @ramonfincken some extra additions/improvements for more security to add to this security aspect about the CSS standard field in the Customizer?

Not quite .. there is a capability named unfiltered_html ​https://wordpress.org/support/article/roles-and-capabilities/#unfiltered_html so in line of that you might want to give only (fully) admin role-level CSS and JS. All others get CSS only.

But.. that does NOT fix any DB injections that will take place with crappy plugins. You need some filtering. I am not aware of any 100% true positive regex filter to filter out any bad line of JS.

[desrosj]

Hi @marcorinia,

Welcome to Trac!

Thanks for this ticket. I am not seeing any actionable items here. Without being able to identify a specific problem that we are trying to solve, it's not really feasible to explore changes to make. If there are specific attack vectors, then those should be detailed and disclosed responsibly to the security team.

As for the security policy, you can find a detailed breakdown of the project's security policy here: ​https://wordpress.org/about/security/. The best place to disclose security vulnerabilities is on the project's HackerOne: ​https://hackerone.com/wordpress