[personal-wp] Ask before applying blueprints to your site

[akirk]

Motivation for the change, related issues

Adds a security confirmation system for blueprints applied to persistent WordPress installations. When a user has an existing WordPress site and tries to apply an external blueprint, they should be warned about what the blueprint will do before it executes.

Screenshots

Security Concerns Addressed

1. Destructive blueprints - Malicious blueprints could delete files or corrupt the installation
2. Data exfiltration - Plugins installed via blueprint could send WordPress data to third-party servers
3. Arbitrary code execution - runPHP steps can execute any PHP code

Trust Model

Blueprints from these sources bypass confirmation:

• https://raw.githubusercontent.com/WordPress/blueprints/ - Official blueprints repo
• https://wordpress.org/plugins/wp-json/plugins/v1/plugin - WordPress.org plugin API
• ?plugin=friends style query params (type: 'none') - Resolves to wordpress.org

Not trusted (requires confirmation):

• data:application/json;base64,... URLs - Can contain arbitrary content
• Inline hash fragments #{...}
• Any other external URLs

Implementation details

Architecture

Blueprint JSON → isTrustedSource() → [trusted: skip] or [untrusted: analyze]
                                              ↓
                                    Run analysis rules
                                              ↓
                                    Show confirmation modal

Rule-based Analysis System

Rule	Analyzes	Severity
run-php	runPHP, runPHPWithOptions steps	Varies by content
filesystem-operations	writeFile, rm, mkdir, etc.	info/warning/danger
external-plugin-source	installPlugin steps	info for wordpress.org, warning for external
external-theme-source	installTheme steps	info for wordpress.org, warning for external
wp-cli	wp-cli steps	warning
request	HTTP request steps	warning

PHP Tokenizer (TypeScript)

Custom synchronous tokenizer that parses PHP code:

• Identifies function calls, variables, strings, backticks, comments
• Tracks line numbers for detailed error reporting
• No external dependencies or async php-wasm needed

PHP Code Analysis

Detects dangerous patterns:

• Danger: eval, system, exec, shell_exec, curl_exec, fsockopen, variable function calls ($func())
• Warning: file_get_contents, base64_decode, wp_remote_get, wp_insert_user, superglobals ($_GET, $_POST)
• Info: phpinfo, update_option, getenv

File Content Analysis

Analyzes writeFile step content:

• Detects PHP code injection patterns
• Flags webshell signatures
• Warns about PHP files in suspicious locations (uploads, cache dirs)
• Checks for backdoor patterns (eval(base64_decode(...)))

Test Coverage

152 unit tests covering:

• Tokenizer: 22 tests
• PHP Analyzer: 25 tests
• All 6 rules with edge cases
• Trusted source detection: 13 tests

Testing Instructions (or ideally a Blueprint)

Run the test suite:

npx nx test playground-personal-wp --testFile=blueprint-confirmation

Manual testing:

1. Start personal-wp with an existing WordPress installation
2. Apply an untrusted blueprint URL
3. Verify confirmation modal appears with detailed warnings
4. Test trusted sources bypass confirmation (install app from menu)