3

There are so many free, freemium and premium Themes out there. How can I be sure that a Theme I download doesn't have malware in the code? Is there an (relatively) easy way to check for malicious code without going through every line of code?

4

You should try using the theme check plugin at http://wordpress.org/extend/plugins/theme-check/

3

Antivirus Check for Wordpress themes: http://wpantivirus.com

-1

Make a cross file search for eval. If you find this one then the author (or someone who ripped it) has something to hide.

5
  • I make use of eval in a custom template engine while modifying dom trees. Does that mean I'm trying to hide something?
    – Twifty
    Oct 9 '13 at 4:48
  • @Waldermort There's absolutely no need to use eval to modify DOM trees. You got DOMElement and DOMDocument for that. If this isn't possible, then you'll have to elaborate. Further: Read the question title. Then tell me this isn't a valid answer. Anyway, if you're using eval, then you're probably doing something wrong/misusing something.
    – kaiser
    Oct 9 '13 at 10:55
  • After I have parsed a DOM tree (and stored references to nodes of interest), then merging that tree into another document, those references become invalid. I solved this by instead of storing a reference, I store the path ie. ->childNodes->item(2). After the whole DOM has been inserted into another document, I can quickly get a reference to those nodes using eval. Granted this can be done using arrays and loops (XPath has a lot of branching) but eval is much cleaner and easier to read. Your answer of has something to hide is plain wrong.
    – Twifty
    Oct 9 '13 at 11:38
  • @Waldermort as we're already arguing about that :) ... I'm not able to imagine your setup completely - would have to see that in code and understand what your idea, task and goal is. You know that WordPress got the Filesystem API? And the DOM* classes are really easy to use and much less expensive to search than with Regexes or than storing references in the DB. And then there's the separation of concerns: Such stuff doesn't belong in a theme. It's plugin material.
    – kaiser
    Oct 9 '13 at 11:49
  • Since you mention it, my code is in a plugin, but could easily be extended to a theme. Infact, imagine a twig or DJango based theme. I make use of the DomDocument API directly in an effort to implement a template inheritance where HTML elements can be inserted into the main page by plugins (yes plugins for my plugin). Storing the path to a DomNode and later referencing with an eval enables me to use the same DOM across documents, store the state in WP's settings and perform expensive searches/validations only once. The same could be done with XPath with a performance cost.
    – Twifty
    Oct 9 '13 at 12:02
-1

Look for <hidden> <iframe> <eval> <height=0> <width=0>

Lot's of real life detection for malicious injections in the website files: http://quttera.blogspot.co.il/search/label/Web%20malware%20scan%20reports%20and%20analysis

Look for similar stuff in your website files.

To do the whole sitecheck from your WP dashboard for exploits and malware use this one: http://wordpress.org/extend/plugins/quttera-web-malware-scanner/

2
  • hidden can be used for form input fields, eval is used in template engines, height=0 and width=0 can be used to hide screen reader texts. You are misleading people into thinking that these strings are all malicious.
    – Twifty
    Oct 9 '13 at 4:52
  • @Waldermort I believe it is obvious that my answer implied that NOT the tags THEMSELVES are malicious but that you might want to start from reviewing what's under the hood.
    – max81
    Nov 4 '13 at 16:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.