WPScan API: Ensure comments are only submitted for changed add-ons

[gudmdharalds]

This pull request introduces code to ensure that WPScan API issues are only submitted for files changed. Previously comments could be submitted for vulnerable/obsolete add-ons that are placed in sub-directories of other add-ons, even if they were not altered. This pull request resolves this by introducing logic to associate all add-ons with changes in pull requests, and if that cannot be done, no comment will be posted for these add-ons.

TODO:

• Function to ensure issues are only submitted for changed plugins (vipgoci_wpscan_filter_unchanged_addons())
  • Rename function to vipgoci_wpscan_get_altered_addons_data_and_slugs()
• Function to determine what add-ons do not have associated changes in pull requests (vipgoci_wpcore_misc_get_addons_not_altered()).
• Add/update tests
  • Update tests/integration/WpscanScanDirsAlteredTest.php
  • Update tests/integration/WpscanScanFindAddonDirsAlteredTest.php
  • Update tests/integration/WpscanScanSaveForSubmissionTest.php
  • Add test for vipgoci_wpscan_get_altered_addons_data_and_slugs()
  • Add test for vipgoci_wpcore_misc_get_addons_not_altered()
• Add to, or update, Scan run detail report as applicable
• Check status of automated tests
• Ensure PHPDoc comments are up to date for functions added or altered
• Changelog entry (for VIP) [ Changelog for version 1.3.3 #312 ]

[wpcomvip-vipgoci-bot]

Code analysis identified issues

VIP Code Analysis Bot has identified potential problems in this pull request during automated scanning. We recommend reviewing the issues noted and that they are resolved.

phpcs scanning turned up:

🚫 16 errors

⚠️ 3 warnings

---

This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.

---

Scan run detail

Software versions vip-go-ci version: 1.3.2 PHP runtime version for vip-go-ci: 8.1.12 PHP runtime for linting: PHP 8.1: 8.1.12 PHP runtime version for PHPCS: 7.4.33 PHPCS version: 3.7.1 PHP runtime version for SVG scanner: 7.4.33 Options file (.vipgoci_options) Options file enabled: true Configurable options: skip-execution skip-draft-prs lint-modified-files-only phpcs phpcs-severity phpcs-sniffs-include phpcs-sniffs-exclude report-no-issues-found review-comments-sort review-comments-include-severity post-generic-pr-support-comments review-comments-sort scan-details-msg-include svg-checks autoapprove autoapprove-php-nonfunctional-changes Options altered: phpcs-severityset to1 phpcs-sniffs-includeset toGeneric.PHP.DisallowShortOpenTag, Squiz.PHP.CommentedOutCode phpcs-sniffs-excludeset toWordPress.Security.EscapeOutput, WordPress.PHP.DevelopmentFunctions, WordPress.WP.AlternativeFunctions, WordPress.PHP.DiscouragedPHPFunctions, WordPress.Files.FileName, Squiz.Commenting.FileComment, Generic.PHP.Syntax skip-draft-prsset to

PHP lint options PHP lint files enabled: true Lint modified files only: true Directories not PHP linted: None SVG configuration SVG scanning enabled: true Auto-approval configuration Auto-approvals enabled: true Non-functional changes auto-approved: true Auto-approved file-types: css csv eot gif gz ico ini jpeg jpg json less map md mdown mo mp4 otf pcss pdf po pot png sass scss styl ttf txt woff woff2 yml

PHPCS configuration PHPCS scanning enabled: true PHPCS severity level: 1 Standard(s) used: PHPCompatibility PHPCompatibilityParagonieRandomCompat PHPCompatibilityParagonieSodiumCompat VariableAnalysis WordPress Runtime set: testVersion 8.1- Custom sniffs included: Generic.PHP.DisallowShortOpenTag Squiz.PHP.CommentedOutCode Custom sniffs excluded: WordPress.Security.EscapeOutput WordPress.PHP.DevelopmentFunctions WordPress.WP.AlternativeFunctions WordPress.PHP.DiscouragedPHPFunctions WordPress.Files.FileName Squiz.Commenting.FileComment Generic.PHP.Syntax Directories not PHPCS scanned: None WPScan API configuration WPScan API scanning enabled: false

Posting will continue in further review(s)

[wpcomvip-vipgoci-bot]

Previous scan continued.

Dismissing review as all inline comments are obsolete by now

[wpcomvip-vipgoci-bot]

Scanning latest commit did not yield any new issues. Please have a look at older feedback still existing (commit-ID: 77d49c6)

---

This bot provides automated PHP linting and PHPCS scanning. For more information about the bot and available customizations, see our documentation.

---

---

Scan run detail

Software versions vip-go-ci version: 1.3.2 PHP runtime version for vip-go-ci: 8.1.12 PHP runtime for linting: PHP 8.1: 8.1.12 PHP runtime version for PHPCS: 7.4.33 PHPCS version: 3.7.1 PHP runtime version for SVG scanner: 7.4.33 Options file (.vipgoci_options) Options file enabled: true Configurable options: skip-execution skip-draft-prs lint-modified-files-only phpcs phpcs-severity phpcs-sniffs-include phpcs-sniffs-exclude report-no-issues-found review-comments-sort review-comments-include-severity post-generic-pr-support-comments review-comments-sort scan-details-msg-include svg-checks autoapprove autoapprove-php-nonfunctional-changes Options altered: phpcs-severityset to1 phpcs-sniffs-includeset toGeneric.PHP.DisallowShortOpenTag, Squiz.PHP.CommentedOutCode phpcs-sniffs-excludeset toWordPress.Security.EscapeOutput, WordPress.PHP.DevelopmentFunctions, WordPress.WP.AlternativeFunctions, WordPress.PHP.DiscouragedPHPFunctions, WordPress.Files.FileName, Squiz.Commenting.FileComment, Generic.PHP.Syntax skip-draft-prsset to

PHP lint options PHP lint files enabled: true Lint modified files only: true Directories not PHP linted: None SVG configuration SVG scanning enabled: true Auto-approval configuration Auto-approvals enabled: true Non-functional changes auto-approved: true Auto-approved file-types: css csv eot gif gz ico ini jpeg jpg json less map md mdown mo mp4 otf pcss pdf po pot png sass scss styl ttf txt woff woff2 yml

PHPCS configuration PHPCS scanning enabled: true PHPCS severity level: 1 Standard(s) used: PHPCompatibility PHPCompatibilityParagonieRandomCompat PHPCompatibilityParagonieSodiumCompat VariableAnalysis WordPress Runtime set: testVersion 8.1- Custom sniffs included: Generic.PHP.DisallowShortOpenTag Squiz.PHP.CommentedOutCode Custom sniffs excluded: WordPress.Security.EscapeOutput WordPress.PHP.DevelopmentFunctions WordPress.WP.AlternativeFunctions WordPress.PHP.DiscouragedPHPFunctions WordPress.Files.FileName Squiz.Commenting.FileComment Generic.PHP.Syntax Directories not PHPCS scanned: None WPScan API configuration WPScan API scanning enabled: false