SECURITY.md in WCPOS – Point of Sale (POS) plugin for WooCommerce 1.9.17, at SECURITY.md

24 lines 2.1 KB Raw Download Zip

1	# Security Notes
2
3	## Open Dependency Advisories
4
5	### PKSA-y2cr-5h3j-g3ys: firebase/php-jwt
6
7	- Status: open until WCPOS can require PHP 8+ or a PHP 7.4-compatible php-jwt patch is available.
8	- Advisory: https://github.com/advisories/GHSA-2x45-7fc3-mxwq
9	- Last reviewed: 2026-05-07
10	- Affected dependency: `php-scoper/composer.json` currently requires `firebase/php-jwt` as `^6.10.0`.
11	- Upgrade blocker: `php-scoper/composer.json` pins Composer's platform PHP version to `7.4`; the patched `firebase/php-jwt` release line requires PHP 8+.
12	- Current parser paths:
13	- `includes/Services/Auth.php::validate_token()` decodes access and refresh JWTs with local HS256 secrets and validates `iss`, token `type`, user ID, and revocation state.
14	- `includes/API.php::authenticate()` accepts REST API bearer tokens and delegates validation to `Services\Auth::validate_token()`.
15	- `includes/Init.php::determine_current_user_early()` accepts early REST bearer or authorization-parameter tokens and delegates validation to `Services\Auth::validate_token()`.
16	- `includes/Form_Handler.php::pay_action()` accepts checkout cashier tokens from `wcpos_jwt` or legacy `token` query parameters and delegates validation to `Services\Auth::validate_token()`.
17	- `includes/API/Auth.php::refresh_token()` and `includes/API/Auth.php::get_current_jti_from_request()` validate refresh and access tokens through `Services\Auth::validate_token()`.
18	- Required mitigations while pinned:
19	- Continue using local HS256 secrets with explicit `Key` instances; do not use remote key sets or claim-provided key URLs.
20	- Validate issuer claims against the current site URL before trusting a decoded token.
21	- Validate token type, user ID, JTI, refresh JTI, and revocation state before authorizing requests.
22	- Do not add audience, issuer, language-code, key ID, or URL-like JWT claims from user-controlled input without sanitizing and validating them before token generation or downstream use after decode.
23	- Prefer `Authorization: Bearer <token>` headers. Query-parameter tokens are limited to controlled fallback paths and must be sanitized before validation.
24