外觀
程式碼掃描
自訂外掛的漏洞（Vulnerability）、程式缺陷（Bug）與安全熱點（Security Hotspot）。
需要注意
- 自訂外掛掃描發現 4 個安全漏洞（Vulnerability）
- 自訂外掛發現 117 個程式缺陷（Bug），可能導致非預期行為
- 24 個安全熱點（Security Hotspot）待人工審查，可能存在安全風險
共 3 項 — 1 高 / 2 中
安全漏洞
- 問題：自訂外掛掃描發現 4 個安全漏洞（Vulnerability）
- 原因：外掛程式碼存在已知的安全弱點模式（如 SQL Injection、XSS 等）
- 建議：依 SonarQube 報告逐一修復漏洞，優先處理 CRITICAL 和 BLOCKER 等級
- 影響：此項影響等級：高
- 驗收：Vulnerabilities = 0
程式缺陷
- 問題：自訂外掛發現 117 個程式缺陷（Bug），可能導致非預期行為
- 原因：程式碼邏輯錯誤或未處理的邊界條件
- 建議：依 SonarQube 報告修復 bugs
- 影響：此項影響等級：中
- 驗收：Bugs = 0
安全熱點
- 問題：24 個安全熱點（Security Hotspot）待人工審查，可能存在安全風險
- 原因：程式碼模式符合已知安全風險特徵，需人工確認是否為實際漏洞
- 建議：逐一審查 Security Hotspot，確認風險並修復
- 影響：此項影響等級：中
- 驗收：所有 Security Hotspot 已審查完畢
掃描範圍
僅掃描自訂程式碼，排除WordPress.org 外掛、商業外掛（WPBakery/Slider Revolution 等）、父主題。
| 類型 | 名稱 |
|---|---|
| 外掛 | cw-linepay |
| 外掛 | cw-tappay |
| 外掛 | cw-tappay-2nd |
| 外掛 | cw-tappay-3da-subscription |
| 外掛 | cw-ecpay-ei |
| 外掛 | wc-chailease-payment |
| 外掛 | ld-content-cloner |
| 外掛 | social-login-system |
| 子主題 | puskar-child |
| mu-plugins | — |
掃描摘要
| 程式碼行數 | 38,847 |
| 安全評級 | D |
| 可靠性評級 | E |
| 可維護性評級 | A |
| 重複行比例 | 52.7% |
問題統計
| 類型 | 數量 |
|---|---|
| 漏洞 (Vulnerabilities) | 4 |
| Bugs | 117 |
| Code Smells | 4761 |
| Security Hotspots | 24 |
按來源分類
cw-tappay-2nd（22）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| CRITICAL | php:S4830 | Enable server certificate validation on this SSL/TLS connection. | |
| CRITICAL | php:S5527 | Enable server hostname verification on this SSL/TLS connection. | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Handler" or use it | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MAJOR | php:S3923 | Remove this conditional structure or edit its code blocks so that they're not all the same. | |
| MAJOR | php:S3923 | Remove this conditional structure or edit its code blocks so that they're not all the same. | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$stdResult". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$stdResult". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$intRenewalTotal". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| CRITICAL | javascript:S930 | This function expects no arguments, but 1 was provided. |
cw-tappay（30）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| CRITICAL | php:S4830 | Enable server certificate validation on this SSL/TLS connection. | |
| CRITICAL | php:S5527 | Enable server hostname verification on this SSL/TLS connection. | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Handler" or use it | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MAJOR | php:S3923 | Remove this conditional structure or edit its code blocks so that they're not all the same. | |
| MAJOR | php:S3923 | Remove this conditional structure or edit its code blocks so that they're not all the same. | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$stdResult". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$stdResult". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$intRenewalTotal". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| CRITICAL | javascript:S930 | This function expects no arguments, but 1 was provided. | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Puc_v4p10_Autoloader" or use it | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". |
_unknown（15）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "P_Firewall" or use it | |
| MINOR | Web:MouseEventWithoutKeyboardEquivalentCheck | Add a 'onKeyPress|onKeyDown|onKeyUp' attribute to this <div> tag. | |
| MINOR | Web:MouseEventWithoutKeyboardEquivalentCheck | Add a 'onKeyPress|onKeyDown|onKeyUp' attribute to this <span> tag. | |
| CRITICAL | css:S4657 | Unexpected shorthand "margin" after "margin-top" | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Safe_Mode" or use it | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MAJOR | php:S3923 | Remove this conditional structure or edit its code blocks so that they're not all the same. | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | Web:MouseEventWithoutKeyboardEquivalentCheck | Add a 'onKeyPress|onKeyDown|onKeyUp' attribute to this <span> tag. | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MAJOR | php:S5850 | Group parts of the regex together to make the intended operator precedence explicit. |
cw-ecpay-ei（19）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Puc_v4p10_Autoloader" or use it | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MAJOR | Web:S5256 | Add "<th>" headers to this "<table>". |
cw-linepay（23）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Extend" or use it | |
| BLOCKER | php:S5911 | Create class "Exception" in namespace or check correct import of class | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Handler" or use it | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MAJOR | php:S3923 | Remove this conditional structure or edit its code blocks so that they're not all the same. | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this method "init_form_fields". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this method "get_icon". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this method "process_payment". | |
| MINOR | php:S1784 | Explicitly mention the visibility of this constructor "__construct". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "include" with "include_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "Puc_v4p10_Autoloader" or use it | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S2003 | Replace "require" with "require_once". |
ld-content-cloner（8）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| MAJOR | css:S4649 | Unexpected missing generic font family | |
| MAJOR | php:S1656 | Remove or correct this useless self-assignment | |
| MAJOR | php:S1656 | Remove or correct this useless self-assignment | |
| MAJOR | php:S1656 | Remove or correct this useless self-assignment | |
| MAJOR | php:S1848 | Either remove this useless object instantiation of class "\Licensing\WdmLicense" or use it | |
| MINOR | php:S2003 | Replace "require" with "require_once". | |
| MINOR | php:S1226 | Introduce a new variable instead of reusing the parameter "$licenseStatus". | |
| MAJOR | Web:S5256 | Add "<th>" headers to this "<table>". |
wc-chailease-payment（1）
| 嚴重度 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| MINOR | php:S2003 | Replace "include" with "include_once". |
Security Hotspots（24）
| 風險 | 規則 | 訊息 | 檔案 |
|---|---|---|---|
| HIGH | php:S6418 | 'SECRET' detected in this expression, review this potentially hard-coded secret. | wp-content/mu-plugins/academy-sso-provider.php:13 |
| HIGH | php:S6418 | 'SECRET' detected in this expression, review this potentially hard-coded secret. | wp-content/mu-plugins/academy-user-cart-api.php:21 |
| HIGH | php:S2068 | Detected 'password' in this variable name, review this potentially hardcoded credential. | wp-content/mu-plugins/academy-product-card-admin.bak.20260422_065036/inc/class-academy-apc-admin.php:26 |
| MEDIUM | javascript:S5852 | Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service. | wp-content/plugins/cw-tappay-2nd/js/cw-tappay.js:287 |
| MEDIUM | javascript:S5852 | Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service. | wp-content/plugins/cw-tappay/js/cw-tappay.js:275 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/cw-ecpay-ei/plugin-update-checker/Puc/v4p10/OAuthSignature.php:93 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/cw-ecpay-ei/plugin-update-checker/Puc/v4p10/Scheduler.php:56 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/cw-linepay/plugin-update-checker/Puc/v4p10/OAuthSignature.php:93 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/cw-linepay/plugin-update-checker/Puc/v4p10/Scheduler.php:56 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/cw-tappay/plugin-update-checker/Puc/v4p10/OAuthSignature.php:93 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/cw-tappay/plugin-update-checker/Puc/v4p10/Scheduler.php:56 |
| MEDIUM | php:S2245 | Make sure that using this pseudorandom number generator is safe here. | wp-content/plugins/wc-chailease-payment/includes/class-wc-chailease-payment-gateway-base.php:57 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/mu-plugins/academy-user-cart-api.php:135 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/mu-plugins/academy-user-cart-api.php:166 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/cw-ecpay-ei/plugin-update-checker/Puc/v4p10/OAuthSignature.php:96 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/cw-linepay/plugin-update-checker/Puc/v4p10/OAuthSignature.php:96 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/cw-tappay/plugin-update-checker/Puc/v4p10/OAuthSignature.php:96 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/ld-content-cloner/licensing/class-wdm-plugin-updater.php:48 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/ld-content-cloner/licensing/class-wdm-plugin-updater.php:156 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/social-login-system/social-login-system.php:1453 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/social-login-system/social-login-system.php:1469 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/social-login-system/social-login-system.php:1482 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/social-login-system/social-login-system.php:1506 |
| LOW | php:S4790 | Make sure this weak hash algorithm is not used in a sensitive context here. | wp-content/plugins/wc-chailease-payment/includes/class-wc-chailease-payment-gateway-base.php:57 |
social-login-system（3）