Skip to content
Scan all sorts of themes and files and things!
PHP C++ Other
Find file
Latest commit f222eae Mar 9, 2016 @david-binda david-binda Merge pull request #314 from gudmdharalds/master
Flagging get_intermediate_image_sizes() in VIP, no intermediate images there
Failed to load latest commit information.
assets Adds icon and banner assets Jun 8, 2015
bin
css
js Modifying async to be compatible with multiple different scans. Apr 15, 2014
tests Detailed explanation for get_intermediate_image_sizes() cannot be use… Mar 9, 2016
vendor
vip-scanner Detailed explanation for get_intermediate_image_sizes() cannot be use… Mar 9, 2016
.gitignore Add PHPStorm project files to .gitignore. Aug 5, 2014
.gitmodules Add PHP-Parser submodule Mar 31, 2015
.travis.yml Update WordPress versions to test on. Sep 17, 2015
CONTRIBUTING.md Add CONTRIBUTING.md with instructions on how to add a new test Apr 2, 2015
HACKING.md Add HACKING.md containing a 'Glossary' and a 'Code Walkthrough' Mar 31, 2015
phpunit.xml
readme.md Add PHP >= 5.4 minimum requirement note to readme.md and readme.txt Apr 2, 2015
readme.txt Add PHP >= 5.4 minimum requirement note to readme.md and readme.txt Apr 2, 2015
screenshot-1.png Initial commit. Copying files over from http://plugins.svn.wordpress.… Feb 9, 2012
vip-scanner.php

readme.md

VIP Scanner Build Status

A WordPress plugin that enables you to scan all sorts of themes and files and things.

Contributors: Mohammad Jangda, Automattic, Thorsten Ott, Michael Fields, Filipe Varela, Josh Betz, Mike Blouin, Nick Daugherty and Fränk Klein.

Requires WordPress version 3.4 or greater and PHP >= 5.4.

About

The plugin itself is simply a UI for the VIP Scanner library, which does all the heavy lifting. The library allows you to create arbitrary "Checks" (e.g. UndefinedFunctionCheck), group them together as Reviews (e.g. WP.com Theme Review), and run them against themes, plugins, directories, single files, and even diffs.

This plugin is based on code from the Theme Check (written by Pross and Otto42) and Exploit Scanner (written by donncha) plugins.

Requirements

For parsing PHP files, VIP Scanner uses PHP-Parser, which it includes as a git submodule. When cloning VIP Scanner's git repo, use the --recursive parameter to include PHP-Parser, i.e. git clone --recursive git@github.com:Automattic/vip-scanner.git If you have already cloned the repo without the --recursive parameter and find yourself with an empty vendor/PHP-Parser directory, run git submodule update --init --recursive.

Installation

  1. Upload the plugin folder to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress

or

Install using the Plugin Installer.

Usage

You can find the tool under Tools > VIP Scanner. There, you can choose what type of scan you'd like to perform -- there's a dropdown list on the right hand side, just next to the "Scan" button.

The dropdown allows you to choose between three types of scan:

  1. Undefined Function Check
  2. WP.com Theme Review
  3. VIP Theme Review

Once you have selected a scan type, you can hit the "Scan" button and see the results in the tabbed view below.

WP-CLI

If you prefer to use the wp-cli tool for your check, there's a vip-scanner command with two main actions:

  1. analyze-theme
  2. scan-theme
$ wp vip-scanner
usage: wp vip-scanner analyze-theme [--theme=<theme>] [--scan_type=<scan-type>] [--depth=<depth>]
   or: wp vip-scanner scan-theme [--theme=<theme>] [--scan_type=<scan_type>] [--summary] [--format=<format>]
  • --theme is the theme's path relative to the WP themes directory, for example, vip/test-theme or pub/twentyfourteen. Defaults to the current theme.
  • --scan_type expects one of the following options: "Undefined Function Check", "WP.com Theme Review" or "VIP Theme Review". Defaults to "VIP Theme Review".
  • --depth expects an integer. You can change the parameter to indicate how many levels of hierarchy you would like outputted. 0 outputs everything. Defaults to 1.
  • --summary gives you just an overview of how many files were checked, how many checks were done and how many errors, warnings and blockers were found.
  • --format allows you to select a output format: table, JSON, CSV. Defaults to table.

Changelog

0.8

  • Modified check for pre_option_* to also include option_*

0.7

  • Modified analyzer to use PHP tokens rather than regular expressions
  • New checks, including white/blacklist checking for file types and names
  • Added basic async scanning as an admin bar node
  • WP CLI scan commands now support paths in addition to theme slugs
  • WP CLI scan_type argument is now optional

0.6

  • Analysis tab for analysing functions, classes, namespaces, shortcodes, actions, filters, capabilities, roles, CPTs, taxonomies, scripts, and styles.
  • WP CLI command for analysis: wp vip-scanner analyze-theme
  • New checks, including VCMergeConflictCheck, WordPressCodingStandardsCheck
  • PHP Code Sniffer integration using the WordPress Coding Standards
  • Check improvements: VIPRestrictedCommandsCheck, VIPRestrictedPatternsCheck, PHPShortTagsCheck
  • Added unit testing for some tests

0.5

  • ClamAV Integration
  • New checks, including VIPInitCheck, filter_input, WP_Widget_Tag_Cloud, and more!
  • WP CLI Support (using vip-scanner command)
  • Reducing false positives
  • Adjusting severity of several checks

0.4

  • UI Refresh
  • Exports
  • Auto scan

0.3

  • Various bug fixes, including preventing the annoying upgrade nag between the main VIP Scanner plugin and WP.com Rules.

0.2

  • New checks and scans! VIP_PregFile, EscapingCheck, etc.
  • PHP 5.2 compatibility, props kevinmcgillivray and chrisguitarguy
  • Bump WP version requirement (3.4)
  • Code cleanup, props lance

0.1

  • Initial version, using slightly older versions of the Theme Check plugin's checks.
Something went wrong with that request. Please try again.