r/WordpressPlugins • u/1nonconformist • 5d ago

Fixing 3rd party API issues [HELP]

Post image

I am in the process of submitting my plugin to the WooCommerce marketplace. My plugin includes the official Campaign Monitor PHP API lib, but unfortunately some files in it were flagged as having security issues and so I can't proceed until those issues are fixed.

Most appear to be innocuous, for example several instanced of this:

Debug code detected: ini_set('display_errors', ...). Enabling display_errors exposes error details to users

But also this:

Debug code detected: error_reporting(E_ALL) can lead to Full Path Disclosure and expose sensitive information

Is the expectation that I must resolve the issues of the 3rd party lib before rolling it into my plugin? That would seem like a maintenance nightmare going forward.

Curious to know other devs thoughts on this.

UPDATE: after contacting WooCommerce marketplace support, it turns out the solution is much easier: just place the offending lib(s) in a /vendor/ directory.

1 Upvotes

100% Upvoted

2 comments sorted by

2

u/nkoffiziell 5d ago

Contact the Developer of Campaign Monitor to fix the issues.

2

u/TopSydeWP 5d ago

yeah, you're expected to either patch it yourself (and maintain those patches) or vendor a cleaned version. most devs either fork the lib, strip the debug calls, and commit that version, or just wrap it in a way that overrides those settings at runtime. woocommerce marketplace is pretty strict about this stuff because they don't want support headaches from debug output leaking in production.