core file codemirror csslint.js – current version false positive?

  • Resolved t.schwarz

    (@tschwarz-1)


    8 years, 2 months ago

    Hi,

    I have a brand new installation of (German version) WordPress. Sucuri considers the German (liesmich.txt) as inseure. But also, bizarrely, the file wp-includes/js/codemirror/csslint.js, which was uploaded from a zip immediately previously downloaded from wordpress.org. Restoring the file via sucuri changes the filesize on the server (slightly larger). It’s odd, both files are from the repository, yet they seem to differ?

    Is there any actual security risk involved here?

    For now I’m using the version downloaded by sucuri, so everything is green in the dashboard after deleting the German readme file.

    Thanks for any hint!

Viewing 1 replies (of 1 total)
  • yorman

    (@yorman)

    8 years, 2 months ago

    Sucuri considers the German (liesmich.txt) as inseure

    More than “insecure” I think the plugin simply considers that file suspicious because it is not part of a normal WordPress installation. Normal in the sense that the filename is not part of the checksum list provided by WordPress, the plugin only flags files that are not part of that list or appear to be modified.

    You can mark the file as “fixed” if the warning is a false/positive.

    Restoring the file via sucuri changes the filesize on the server (slightly larger). It’s odd, both files are from the repository, yet they seem to differ?

    I have seen that happen before, mostly with (S)FTP tools.

    The reason for this is because there are different transfer modes and depending on which one is being used the content of the file may be changed, line-endings for example, they could be changed from \r\n to \n.

    Is there any actual security risk involved here?

    Probably not, but there is not 100% certainty without checking the content of the flagged files. Please upload both liesmich.txt and csslint.js to either Pastebin [1] or here [2]. I will check the content of those two files with the files that the German version of WordPress has, and will give you a better answer once I can see the actual differences.

    [1] https://pastebin.com
    [2] https://cixtor.com/pastio

Viewing 1 replies (of 1 total)

The topic ‘core file codemirror csslint.js – current version false positive?’ is closed to new replies.