wpscanteam / wpscan / 30000446734

95%

push

github

Add opt-in local vulnerability database support (--enterprise-db-token) (#2073)

* Add opt-in local vulnerability database support via --enterprise-db-token

Enterprise customers can now scan using a local vulnerability database
dump instead of the WPScan API. When --enterprise-db-token is supplied
(or the WPSCAN_ENTERPRISE_DB_TOKEN env var / enterprise_db_token config
key), the plugins/themes/wordpresses JSON dumps are downloaded from
enterprise-data.wpscan.org (authenticated with the token) during the
normal database update, then read locally — with no per-request API
calls or daily request limits.

The option is mutually exclusive with --api-token, and the token is
redacted from the logged command line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Improve docs for new db token CLI option, and also align the naming for some methods.

* Small doc correction.

* Added missing unit test coverage for WPScan::DB::Updater.

* Make local DB dump vuln results match the API exactly

Route affected_versions parsing through Vulnerability.affected_versions_from
so the API and enterprise DB dump paths filter vulnerabilities against the
detected version identically. Legacy flat fixed_in/introduced_in entries are
wrapped into a single range for backward compatibility.

Also sort vulnerabilities oldest-first (created_at, updated_at, id) in WpItem
and WpVersion via Vulnerability.sort_json, so the API and the reverse-ordered
dump report the same sequence and the output order matches the pre-dump
behaviour.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Validate conflicting API tokens before the DB update

The --api-token / --enterprise-db-token mutual-exclusion check lived in
VulnApi#before_scan, which runs after Core's DB update: a run with both
tokens still downloaded the full DB + enterprise dumps before aborting,
and --update-only runs (no --url) exited without reporting the conflict
at all.

The check is now ... (continued)

2350 of 2911 branches covered (80.73%)

4893 of 5124 relevant lines covered (95.49%)

19700.69 hits per line