PATTERN-LIBRARY.json

{
  "version": "1.0.0",
  "generated": "2026-03-24T01:34:38Z",
  "summary": {
    "total_patterns": 56,
    "enabled": 56,
    "disabled": 0,
    "by_severity": {
      "CRITICAL": 20,
      "HIGH": 17,
      "MEDIUM": 14,
      "LOW": 4
    },
    "by_category": {
      "performance": 22,"Performance": 5,"duplication": 5,"reliability": 6,"security": 14
    },
    "by_pattern_type": {
      "php": 45,
      "headless": 6,
      "nodejs": 4,
      "javascript": 1
    },
    "mitigation_detection_enabled": 7,
    "heuristic_patterns": 18,
    "definitive_patterns": 38
  },
  "patterns": [
    {
	"id": "ajax-polling-unbounded",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "HIGH",
	"title": "Unbounded AJAX polling (setInterval + fetch/ajax)",
	"description": "Detects setInterval() calls that perform AJAX requests without rate limiting, which can cause excessive server load.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "ajax-polling-unbounded.json",
  "search_pattern": "setInterval[[:space:]]*\\(",
  "file_patterns": ["*.js"],
  "validator_script": "validators/context-pattern-check.sh",
  "validator_args": ["\\.ajax|fetch\\(|axios\\(|XMLHttpRequest|wp\\.apiFetch", "5", "after"]
},
{
	"id": "array-merge-in-loop",
	"version": "1.0.0",
	"enabled": true,
	"category": "Performance",
	"severity": "LOW",
	"title": "array_merge() inside loops (heuristic)",
	"description": "Detects array_merge() calls inside loops that can cause quadratic memory usage and performance degradation. The pattern $x = array_merge($x, ...) inside a loop creates a new array on each iteration.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "array-merge-in-loop.json",
  "search_pattern": "\\$[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]*=[[:space:]]*array_merge\\([[:space:]]*\\$[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]*,",
  "file_patterns": ["*.php"],
  "validator_script": "validators/loop-context-check.sh",
  "validator_args": []
},
{
	"id": "asset-version-time",
	"version": "1.0.0",
	"enabled": true,
	"category": "Performance",
	"severity": "MEDIUM",
	"title": "Script/style versioning with time()",
	"description": "Using time() as the version parameter for wp_enqueue_script() or wp_enqueue_style() prevents browser caching and forces re-download on every page load, significantly impacting performance.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "asset-version-time.json",
  "search_pattern": "wp_(register|enqueue)_(script|style)[[:space:]]*\\([^)]*,[[:space:]]*time[[:space:]]*\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "db-query-in-constructor",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "HIGH",
	"title": "Database queries in __construct() methods",
	"description": "Detects database queries (get_users, get_posts, WP_Query, $wpdb) inside __construct() methods. Constructors run on every class instantiation, often on every page load when using singleton pattern. DB queries should be lazy-loaded or moved to admin-only hooks. Note: Only detects direct DB calls in constructors; does not detect indirect queries through method calls.",
	"detection_type": "scripted",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "db-query-in-constructor.json",
  "search_pattern": "function[[:space:]]+__construct[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/context-pattern-check.sh",
  "validator_args": ["get_users|get_posts|WP_Query|WP_User_Query|wpdb->get_|wpdb->query|wc_get_orders|wc_get_products", "50", "after"]
},
{
	"id": "disallowed-php-short-tags",
	"version": "",
	"enabled": true,
	"category": "KISS",
	"severity": "MEDIUM",
	"title": "Disallowed PHP short tags",
	"description": "WordPress Coding Standards require full <?php tags instead of short tags (<?= or <? ). Short tags may not be enabled on all servers and can cause compatibility issues.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "disallowed-php-short-tags.json",
  "search_pattern": "<\\?=|<\\?[[:space:]]",
  "file_patterns": ["*.php"]
},
{
	"id": "duplicate-capability-strings",
	"version": "1.0.0",
	"enabled": true,
	"category": "duplication",
	"severity": "LOW",
	"title": "Duplicate capability strings across files",
	"description": "Detects current_user_can() and user_can() calls with hard-coded capability strings appearing in many files. While some duplication is normal (e.g., 'manage_options'), excessive duplication suggests capability checks should be centralized.",
	"detection_type": "aggregated",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "duplicate-capability-strings.json",
  "search_pattern": "(current_user_can|user_can)\\( *['\"]([a-z0-9_]+)['\"]",
  "file_patterns": ["*.php"]
},
{
	"id": "duplicate-functions",
	"version": "1.0.0",
	"enabled": true,
	"category": "duplication",
	"severity": "MEDIUM",
	"title": "Duplicate function definitions across files",
	"description": "Detects exact function clones (Type 1) using hash-based comparison of normalized function bodies. Functions with identical logic (after removing comments and normalizing whitespace) appearing in multiple files indicate copy-paste violations.",
	"detection_type": "clone_detection",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "duplicate-functions.json",
  "file_patterns": ["*.php"]
},
{
	"id": "duplicate-option-names",
	"version": "1.0.0",
	"enabled": true,
	"category": "duplication",
	"severity": "MEDIUM",
	"title": "Duplicate option names across files",
	"description": "Detects get_option(), update_option(), and delete_option() calls with hard-coded option names appearing in multiple files. This indicates a DRY violation where option names should be centralized as constants.",
	"detection_type": "aggregated",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "duplicate-option-names.json",
  "search_pattern": "(get_option|update_option|delete_option|add_option)\\( *['\"]([a-z0-9_]+)['\"]",
  "file_patterns": ["*.php"]
},
{
	"id": "duplicate-transient-keys",
	"version": "1.0.0",
	"enabled": true,
	"category": "duplication",
	"severity": "MEDIUM",
	"title": "Duplicate transient keys across files",
	"description": "Detects get_transient(), set_transient(), and delete_transient() calls with hard-coded transient keys appearing in multiple files. This indicates a DRY violation where transient keys should be centralized as constants.",
	"detection_type": "aggregated",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "duplicate-transient-keys.json",
  "search_pattern": "(get_transient|set_transient|delete_transient)\\( *['\"]([a-z0-9_]+)['\"]",
  "file_patterns": ["*.php"]
},
{
	"id": "file-get-contents-url",
	"version": "",
	"enabled": true,
	"category": "Performance",
	"severity": "HIGH",
	"title": "file_get_contents() with external URLs",
	"description": "Using file_get_contents() for external URLs is insecure and slow. WordPress provides wp_remote_get() which handles timeouts, SSL verification, and error handling properly.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "file-get-contents-url.json",
  "search_pattern": "file_get_contents[[:space:]]*\\([[:space:]]*['\"]https?://|file_get_contents[[:space:]]*\\([[:space:]]*\\$",
  "file_patterns": ["*.php"]
},
{
	"id": "get-users-no-limit",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "get_users() without 'number' limit",
	"description": "Detects get_users() calls without the 'number' parameter, which can fetch ALL users from the database and cause memory exhaustion on large sites.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "get-users-no-limit.json",
  "search_pattern": "get_users[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/parameter-presence-check.sh",
  "validator_args": ["number", "10"]
},
{
	"id": "hcc-005-expensive-polling",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "HIGH",
	"title": "Expensive WP functions in polling intervals (HCC-005)",
	"description": "Detects expensive WordPress functions (get_plugins, get_themes, WP_Query, etc.) called within setInterval polling loops, which can cause severe performance degradation.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "hcc-005-expensive-polling.json",
  "search_pattern": "setInterval[[:space:]]*\\(",
  "file_patterns": ["*.js", "*.php"],
  "validator_script": "validators/context-pattern-check.sh",
  "validator_args": ["get_plugins\\(|get_themes\\(|get_posts\\(|WP_Query|get_users\\(|wp_get_recent_posts\\(|get_categories\\(|get_terms\\(", "20", "after"]
},
{
	"id": "headless-api-key-exposure",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "API keys/secrets exposed in client-side code",
	"description": "Detects API keys, secrets, tokens, or passwords that may be exposed in client-side JavaScript bundles. In headless WordPress setups, this commonly happens with NEXT_PUBLIC_ environment variables containing sensitive values.",
	"detection_type": "direct",
	"pattern_type": "headless",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "api-key-exposure.json",
  "search_pattern": "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)[[:space:]]*=[[:space:]]*['\"][a-zA-Z0-9_-]{16,}['\"]|process\\.env\\.NEXT_PUBLIC_[A-Z_]*(SECRET|KEY|TOKEN|PASSWORD|PRIVATE)|process\\.env\\.NUXT_PUBLIC_[A-Z_]*(SECRET|KEY|TOKEN|PASSWORD)|import\\.meta\\.env\\.VITE_[A-Z_]*(SECRET|KEY|TOKEN|PASSWORD)",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "headless-fetch-no-error-handling",
	"version": "1.0.0",
	"enabled": true,
	"category": "reliability",
	"severity": "HIGH",
	"title": "fetch/axios calls without error handling",
	"description": "Detects fetch() or axios calls to WordPress REST API endpoints without proper error handling. Missing error handling leads to silent failures, broken UIs, and poor user experience.",
	"detection_type": "direct",
	"pattern_type": "headless",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "fetch-no-error-handling.json",
  "search_pattern": "fetch\\([^)]*wp-json|axios\\.(get|post|put|delete)\\([^)]*wp-json|await[[:space:]]+fetch\\(",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "headless-graphql-no-error-handling",
	"version": "1.0.0",
	"enabled": true,
	"category": "reliability",
	"severity": "HIGH",
	"title": "GraphQL queries/mutations without error handling",
	"description": "Detects Apollo Client useQuery/useMutation hooks without error handling. Missing error handling in GraphQL operations leads to silent failures and broken UIs.",
	"detection_type": "direct",
	"pattern_type": "headless",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "graphql-no-error-handling.json",
  "search_pattern": "useQuery\\([^)]+\\)|useMutation\\([^)]+\\)|useSWR\\([^)]+\\)",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "headless-hardcoded-wordpress-url",
	"version": "1.0.0",
	"enabled": true,
	"category": "maintainability",
	"severity": "MEDIUM",
	"title": "Hardcoded WordPress API URL",
	"description": "Detects hardcoded WordPress REST API or GraphQL URLs instead of environment variables. Hardcoded URLs break deployments across different environments (dev, staging, production).",
	"detection_type": "direct",
	"pattern_type": "headless",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "hardcoded-wordpress-url.json",
  "search_pattern": "fetch\\([[:space:]]*['\"]https?://[^'\"]+/wp-json|uri:[[:space:]]*['\"]https?://[^'\"]+/graphql['\"]|(const|let|var)[[:space:]]+[A-Z_]*URL[[:space:]]*=[[:space:]]*['\"]https?://[^'\"]*wordpress[^'\"]*['\"]|baseURL:[[:space:]]*['\"]https?://[^'\"]+['\"]",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "headless-missing-auth-headers",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "HIGH",
	"title": "WordPress REST API calls missing authentication",
	"description": "Detects fetch/axios calls to WordPress REST API endpoints that modify data (POST, PUT, DELETE) without proper authentication headers or credentials mode.",
	"detection_type": "direct",
	"pattern_type": "headless",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "missing-auth-headers.json",
  "search_pattern": "fetch\\([^)]*wp-json[^)]*method:[[:space:]]*['\"]POST['\"]|fetch\\([^)]*wp-json[^)]*method:[[:space:]]*['\"]PUT['\"]|fetch\\([^)]*wp-json[^)]*method:[[:space:]]*['\"]DELETE['\"]|fetch\\([^)]*wp-json[^)]*status=draft",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "headless-nextjs-missing-revalidate",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "MEDIUM",
	"title": "Next.js getStaticProps without revalidate (stale WordPress data)",
	"description": "Detects Next.js getStaticProps that fetch WordPress data but don't include a revalidate property, causing WordPress content to never update after initial build.",
	"detection_type": "direct",
	"pattern_type": "headless",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "nextjs-missing-revalidate.json",
  "search_pattern": "export[[:space:]]+(async[[:space:]]+)?function[[:space:]]+getStaticProps|export[[:space:]]+const[[:space:]]+getStaticProps[[:space:]]*=[[:space:]]*(async)?",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "http-no-timeout",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "MEDIUM",
	"title": "HTTP requests without timeout",
	"description": "Detects wp_remote_get/post/request/head calls without explicit timeout parameters, which can hang the entire site if the remote server doesn't respond.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "http-no-timeout.json",
  "search_pattern": "wp_remote_(get|post|request|head)[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/http-timeout-check.sh",
  "validator_args": ["20"]
},
{
	"id": "duplicate-storage-keys",
	"version": "1.0.0",
	"enabled": true,
	"category": "duplication",
	"severity": "LOW",
	"title": "Duplicate localStorage/sessionStorage keys across files",
	"description": "Detects storage keys that appear in multiple JavaScript files. Duplicate storage keys indicate potential key collisions or inconsistent key management.",
	"detection_type": "aggregated",
	"pattern_type": "javascript",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "duplicate-storage-keys.json",
  "search_pattern": "(localStorage|sessionStorage)\\.(getItem|setItem)\\([[:space:]]*['\"]([a-zA-Z0-9_-]+)['\"]",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "kiss-sbi-patterns",
	"version": "",
	"enabled": true,
	"category": "",
	"severity": "warning",
	"title": "",
	"description": "A collection of patterns specific to the KISS Smart Batch Installer plugin.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "kiss-sbi.json",
  "file_patterns": ["*.php"]
},
{
	"id": "like-leading-wildcard",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "MEDIUM",
	"title": "LIKE queries with leading wildcards",
	"description": "Detects SQL LIKE queries with leading wildcards (LIKE '%...'), which prevent database index usage and cause full table scans.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "like-leading-wildcard.json",
  "search_pattern": "LIKE[[:space:]]+['\"]%",
  "file_patterns": ["*.php"]
},
{
	"id": "limit-multiplier-from-count",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "MEDIUM",
	"title": "Query limit multiplier derived from count()",
	"description": "Detects patterns like count($ids) * N used to derive query limits/candidate limits. This can multiply unexpectedly and trigger OOM when combined with object hydration.",
	"detection_type": "grep",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "limit-multiplier-from-count.json",
  "search_pattern": "count\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "njs-002-command-injection",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Potential command injection (child_process)",
	"description": "Detects usage of child_process.exec, execSync, or spawn with shell:true that may be vulnerable to command injection.",
	"detection_type": "direct",
	"pattern_type": "nodejs",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "command-injection.json",
  "search_pattern": "exec[[:space:]]*\\([[:space:]]*[a-zA-Z_$]|execSync[[:space:]]*\\([[:space:]]*[a-zA-Z_$]|spawn[[:space:]]*\\([^)]*shell:[[:space:]]*true",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "njs-001-eval-injection",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Dangerous eval() or code execution",
	"description": "Detects usage of eval(), Function constructor, and other code execution patterns that can lead to code injection vulnerabilities.",
	"detection_type": "direct",
	"pattern_type": "nodejs",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "eval-injection.json",
  "search_pattern": "eval[[:space:]]*\\(|new[[:space:]]+Function[[:space:]]*\\(|Function[[:space:]]*\\([[:space:]]*['\"]",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "njs-003-path-traversal",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "HIGH",
	"title": "Potential path traversal in fs operations",
	"description": "Detects file system operations that may be vulnerable to path traversal attacks via '../' sequences in user input.",
	"detection_type": "direct",
	"pattern_type": "nodejs",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "path-traversal.json",
  "search_pattern": "fs\\.(readFile|readFileSync|writeFile|writeFileSync|unlink|unlinkSync)[[:space:]]*\\([^)]*\\+|fs\\.(readFile|readFileSync|writeFile|writeFileSync)[[:space:]]*\\([[:space:]]*[a-zA-Z_$][a-zA-Z0-9_$]*[[:space:]]*[,)]",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "njs-004-unhandled-promise",
	"version": "1.0.0",
	"enabled": true,
	"category": "reliability",
	"severity": "HIGH",
	"title": "Promise without error handling",
	"description": "Detects promises that lack .catch() handlers or async functions without try/catch blocks, which can lead to unhandled promise rejections.",
	"detection_type": "direct",
	"pattern_type": "nodejs",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "unhandled-promise.json",
  "search_pattern": "\\.then[[:space:]]*\\([^)]+\\)[[:space:]]*;[[:space:]]*$|Promise\\.all[[:space:]]*\\([^)]+\\)\\.then",
  "file_patterns": ["*.js", "*.jsx", "*.ts", "*.tsx"]
},
{
	"id": "nonstandard-wordpress-translation-alias",
	"version": "1.0.0",
	"enabled": true,
	"category": "reliability",
	"severity": "MEDIUM",
	"title": "Non-standard WordPress translation alias `_()`",
	"description": "Detects `_()` calls in WordPress PHP code. WordPress standard translation helpers are `__()`, `esc_html__()`, `esc_attr__()`, and related native APIs. Using `_()` introduces ambiguity, reduces readability, and can cause compatibility or bootstrap fragility in real-world theme/plugin environments.",
	"detection_type": "simple",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "nonstandard-wordpress-translation-alias.json",
  "search_pattern": "(^|[^[:alnum:]_])_[[:space:]]*\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "nopaging-true",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "nopaging => true",
	"description": "Detects WP_Query calls with 'nopaging' => true, which disables pagination and retrieves all matching posts, potentially causing memory exhaustion.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "nopaging-true.json",
  "search_pattern": "nopaging[[:space:]]*=>[[:space:]]*true",
  "file_patterns": ["*.php"]
},
{
	"id": "order-by-rand",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "HIGH",
	"title": "Randomized ordering (ORDER BY RAND)",
	"description": "Detects queries using ORDER BY RAND() or 'orderby' => 'rand', which causes full table scans and is extremely slow on large datasets.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "order-by-rand.json",
  "search_pattern": "orderby[[:space:]]*=>[[:space:]]*['\"]rand['\"]|ORDER[[:space:]]+BY[[:space:]]+RAND\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "php-dynamic-include",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Dynamic PHP include/require with variables",
	"description": "Detects include/require statements where the path expression contains variables. Dynamic includes are a common source of local/remote file inclusion vulnerabilities.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "php-dynamic-include.json",
  "search_pattern": "include(_once)?[[:space:]]+[^;]*\\$|require(_once)?[[:space:]]+[^;]*\\$",
  "file_patterns": ["*.php"]
},
{
	"id": "php-eval-injection",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Dangerous eval() usage in PHP",
	"description": "Detects eval() calls in PHP code, which execute arbitrary code and are almost never safe in WordPress plugins/themes.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "php-eval-injection.json",
  "search_pattern": "eval[[:space:]]*\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "php-hardcoded-credentials",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Hardcoded credentials in PHP",
	"description": "Detects API keys, secrets, tokens, or passwords hardcoded into PHP source files.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "php-hardcoded-credentials.json",
  "search_pattern": "\\$[A-Za-z0-9_]*(password|passwd|secret|token|api_key|apikey|auth_token)[A-Za-z0-9_]*[[:space:]]*=[[:space:]]*['\"][^'\"]{8,}['\"]|\\$[A-Z0-9_]*(PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|AUTH_TOKEN)[A-Z0-9_]*[[:space:]]*=[[:space:]]*['\"][^'\"]{8,}['\"]|define[[:space:]]*\\([[:space:]]*['\"][A-Z0-9_]*(SECRET|TOKEN|PASSWORD|KEY|API)[A-Z0-9_]*['\"][[:space:]]*,[[:space:]]*['\"][^'\"]{8,}['\"]|\"Authorization\"[[:space:]]*=>[[:space:]]*\"Bearer[[:space:]]+[A-Za-z0-9._-]{16,}\"",
  "file_patterns": ["*.php"]
},
{
	"id": "php-shell-exec-functions",
	"version": "",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Shell command execution functions in PHP (shell_exec/exec/system/passthru)",
	"description": "Usage of shell_exec(), exec(), system(), or passthru() in PHP code. These functions execute system commands and are almost never safe in WordPress plugins/themes.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "php-shell-exec-functions.json",
  "search_pattern": "shell_exec[[:space:]]*\\(|exec[[:space:]]*\\(|system[[:space:]]*\\(|passthru[[:space:]]*\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "php-user-controlled-file-write",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Direct file write with user-controlled path",
	"description": "Detects file writes where the target path is derived directly from PHP superglobals (user-controlled input). This is a common pattern for arbitrary file write vulnerabilities.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "php-user-controlled-file-write.json",
  "search_pattern": "file_put_contents[[:space:]]*\\([^,]*\\$_(GET|POST|REQUEST|COOKIE|SERVER|FILES)|fopen[[:space:]]*\\([^,]*\\$_(GET|POST|REQUEST|COOKIE|SERVER|FILES)|move_uploaded_file[[:space:]]*\\([^,]+,[^,]*\\$_(GET|POST|REQUEST|COOKIE|SERVER)",
  "file_patterns": ["*.php"]
},
{
	"id": "pre-get-posts-unbounded",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "pre_get_posts Hook Sets Unbounded Query",
	"description": "Detects files that hook into pre_get_posts and set posts_per_page => -1 or nopaging => true, which can cause memory exhaustion on sites with many posts.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "pre-get-posts-unbounded.json",
  "search_pattern": "add_action.*pre_get_posts|add_filter.*pre_get_posts",
  "file_patterns": ["*.php"],
  "validator_script": "validators/pre-get-posts-unbounded-check.sh",
  "validator_args": ["50"]
},
{
	"id": "rest-no-pagination",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "REST endpoints without pagination/limits",
	"description": "Detects register_rest_route() calls without pagination parameters (per_page, limit, page), which can cause unbounded queries and memory exhaustion.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "rest-no-pagination.json",
  "search_pattern": "register_rest_route[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/context-pattern-absent-check.sh",
  "validator_args": ["'per_page'|\"per_page\"|'page'|\"page\"|'limit'|\"limit\"|pagination|paged|per_page", "15", "after"]
},
{
	"id": "spo-002-superglobals",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "HIGH",
	"title": "Direct superglobal manipulation",
	"description": "Detects direct modification of PHP superglobals ($_GET, $_POST, $_REQUEST, $_COOKIE) which can bypass security filters and create vulnerabilities.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "spo-002-superglobal-manipulation.json",
  "search_pattern": "unset\\(\\$_(GET|POST|REQUEST|COOKIE)\\[|\\$_(GET|POST|REQUEST)[[:space:]]*=|\\$_(GET|POST|REQUEST|COOKIE)\\[[^]]*\\][[:space:]]*=",
  "file_patterns": ["*.php"]
},
{
	"id": "superglobal-with-nonce-context",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "HIGH",
	"title": "Context-aware superglobal detection with nonce verification",
	"description": "Enhanced detection that checks for nonce verification before $_POST/$_GET access. Skips findings when proper nonce + sanitization pattern is detected.",
	"detection_type": "context-aware",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "superglobal-with-nonce-context.json",
  "search_pattern": "\\$_(GET|POST|REQUEST)\\[",
  "file_patterns": ["*.php"]
},
{
	"id": "timezone-sensitive-code",
	"version": "1.0.0",
	"enabled": true,
	"category": "Performance",
	"severity": "LOW",
	"title": "Timezone-sensitive patterns (current_time/date)",
	"description": "Detects timezone-sensitive functions that may cause inconsistent behavior across different server configurations. Uses current_time('timestamp') or date() without proper timezone handling.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "timezone-sensitive-code.json",
  "search_pattern": "current_time[[:space:]]*\\([[:space:]]*['\"]timestamp|[^a-zA-Z_]date[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/phpcs-ignore-check.sh",
  "validator_args": []
},
{
	"id": "transient-no-expiration",
	"version": "1.0.0",
	"enabled": true,
	"category": "Performance",
	"severity": "MEDIUM",
	"title": "Transients without expiration",
	"description": "Detects set_transient() calls that may be missing the expiration parameter. Transients without expiration can accumulate in the database and cause performance issues.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "transient-no-expiration.json",
  "search_pattern": "set_transient[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/transient-expiration-check.sh",
  "validator_args": []
},
{
	"id": "unbounded-numberposts",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "Unbounded numberposts",
	"description": "Detects get_posts() calls with numberposts set to -1, which retrieves all posts without limit and can cause memory exhaustion.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "unbounded-numberposts.json",
  "search_pattern": "numberposts[[:space:]]*=>[[:space:]]*-1",
  "file_patterns": ["*.php"]
},
{
	"id": "unbounded-posts-per-page",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "Unbounded posts_per_page",
	"description": "Detects WP_Query or get_posts() calls with posts_per_page set to -1, which retrieves all posts without limit and can cause memory exhaustion.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "unbounded-posts-per-page.json",
  "search_pattern": "posts_per_page[[:space:]]*=>[[:space:]]*-1",
  "file_patterns": ["*.php"]
},
{
	"id": "unbounded-sql-terms",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "HIGH",
	"title": "Unbounded SQL on wp_terms/wp_term_taxonomy",
	"description": "Detects direct SQL queries on wp_terms or wp_term_taxonomy tables without LIMIT clauses, which can cause performance issues on sites with many terms.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "unbounded-sql-terms.json",
  "search_pattern": "\\$wpdb->(terms|term_taxonomy)",
  "file_patterns": ["*.php"],
  "validator_script": "validators/sql-limit-check.sh",
  "validator_args": ["5"]
},
{
	"id": "unbounded-wc-get-orders",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "Unbounded wc_get_orders()",
	"description": "Detects wc_get_orders() calls with explicit 'limit' => -1, which hydrates full WC_Order objects indefinitely and causes OOM crashes.",
	"detection_type": "grep",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "unbounded-wc-get-orders.json",
  "search_pattern": "wc_get_orders\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "unbounded-wc-get-products",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "Unbounded wc_get_products()",
	"description": "Detects wc_get_products() calls with explicit 'limit' => -1.",
	"detection_type": "grep",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "unbounded-wc-get-products.json",
  "search_pattern": "wc_get_products\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "unsanitized-superglobal-isset-bypass",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "HIGH",
	"title": "Unsanitized superglobal read ($_GET/$_POST)",
	"description": "Detects $_GET/$_POST/$_REQUEST used directly after isset/empty check on same line without sanitization",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "unsanitized-superglobal-isset-bypass.json",
  "search_pattern": "\\$_(GET|POST|REQUEST)\\[",
  "file_patterns": ["*.php"]
},
{
	"id": "unsanitized-superglobal-read",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "HIGH",
	"title": "Unsanitized superglobal read ($_GET/$_POST/$_REQUEST)",
	"description": "Direct access to $_GET, $_POST, or $_REQUEST without sanitization functions. Unlike the isset-bypass pattern, this catches ANY unsanitized access regardless of isset/empty checks.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "unsanitized-superglobal-read.json",
  "search_pattern": "\\$_(GET|POST|REQUEST)\\[",
  "file_patterns": ["*.php"]
},
{
	"id": "wc-coupon-in-thankyou",
	"version": "1.0.0",
	"enabled": true,
	"category": "reliability",
	"severity": "HIGH",
	"title": "Coupon logic in WooCommerce thank-you/order-received context",
	"description": "Detects coupon-related operations (apply_coupon, remove_coupon, WC_Coupon instantiation) in WooCommerce thank-you or order-received contexts. Uses context-aware validation to distinguish between problematic thank-you hooks and safe checkout hooks. Ignores commented-out code and functions hooked to safe contexts like woocommerce_checkout_order_processed.",
	"detection_type": "validated",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "wc-coupon-in-thankyou.json",
  "file_patterns": ["*.php"]
},
{
	"id": "wc-smart-coupons-thankyou-perf",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "HIGH",
	"title": "WooCommerce Smart Coupons active with potential thank-you page performance impact",
	"description": "Detects WooCommerce Smart Coupons plugin which is known to trigger expensive database queries (LOWER(post_title) lookups) on the thank-you/order-received page. This can cause 15-30 second page load times on sites with large wp_posts tables.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "wc-smart-coupons-thankyou-perf.json",
  "file_patterns": ["*.php"]
},
{
	"id": "wcs-get-subscriptions-no-limit",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "MEDIUM",
	"title": "WooCommerce Subscriptions queries without limits",
	"description": "Detects wcs_get_subscriptions*() calls without a 'limit' parameter, which can fetch ALL subscriptions and cause performance issues.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "wcs-no-limit.json",
  "search_pattern": "wcs_get_subscriptions[a-zA-Z_]*[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/parameter-presence-check.sh",
  "validator_args": ["limit", "10"]
},
{
	"id": "wp-json-html-escape",
	"version": "",
	"enabled": true,
	"category": "reliability",
	"severity": "MEDIUM",
	"title": "HTML-escaping in JSON response URL fields",
	"description": "Detects HTML escaping functions (esc_url, esc_attr, esc_html) used in JSON response fields with URL-like names. This can cause double-encoding issues where & becomes &#038; breaking redirects in JavaScript.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": true,
	"file": "wp-json-html-escape.json",
  "file_patterns": ["*.php"]
},
{
	"id": "wp-query-unbounded",
	"version": "2.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "Unbounded WP_Query/get_posts",
	"description": "Detects WP_Query or get_posts with posts_per_page => -1 or nopaging => true, which can fetch ALL posts and cause memory exhaustion.",
	"detection_type": "",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "wp-query-unbounded.json",
  "search_pattern": "new[[:space:]]+WP_Query[[:space:]]*\\(|get_posts[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/context-pattern-check.sh",
  "validator_args": ["posts_per_page[[:space:]]*=>[[:space:]]*-1|nopaging[[:space:]]*=>[[:space:]]*true", "10", "after"],
  "mitigation_details": {"enabled": true, "script": "validators/mitigation-check.sh", "args": ["20"], "severity_downgrade": {"CRITICAL": "HIGH", "HIGH": "MEDIUM", "MEDIUM": "LOW"}}
},
{
	"id": "wp-template-tags-in-loops",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "WordPress template tags in loops (N+1 queries)",
	"description": "Detects WordPress template tag functions (get_the_title, get_the_content, get_permalink, etc.) called inside loops without proper post context. These functions trigger individual database queries for each iteration, causing N+1 query patterns.",
	"detection_type": "scripted",
	"pattern_type": "php",
	"mitigation_detection": false,
	"heuristic": false,
	"file": "wp-template-tags-in-loops.json",
  "search_pattern": "foreach[[:space:]]*\\(|while[[:space:]]*\\(",
  "file_patterns": ["*.php"],
  "validator_script": "validators/wp-template-tags-in-loops.sh",
  "validator_args": []
},
{
	"id": "wp-user-query-meta-bloat",
	"version": "1.0.0",
	"enabled": true,
	"category": "performance",
	"severity": "CRITICAL",
	"title": "WP_User_Query Full Meta Hydration",
	"description": "Detects WP_User_Query without 'update_user_meta_cache' => false.",
	"detection_type": "grep",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "wp-user-query-meta-bloat.json",
  "search_pattern": "new WP_User_Query\\(",
  "file_patterns": ["*.php"]
},
{
	"id": "wpdb-query-no-prepare",
	"version": "1.0.0",
	"enabled": true,
	"category": "security",
	"severity": "CRITICAL",
	"title": "Direct database queries without $wpdb->prepare()",
	"description": "Detects $wpdb->query(), get_var(), get_row(), get_results(), or get_col() called without $wpdb->prepare() wrapper, creating SQL injection vulnerabilities.",
	"detection_type": "direct",
	"pattern_type": "php",
	"mitigation_detection": true,
	"heuristic": false,
	"file": "wpdb-query-no-prepare.json",
  "search_pattern": "\\$wpdb->(query|get_var|get_row|get_results|get_col)\\(",
  "file_patterns": ["*.php"]
}
  ]
}