WP Manifestindependent plugin directory
manifest / developer / wp-ssr

WP SSR WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Server Side Rendering of JavaScript applications inside WordPress templates.

★ 4stars
2.2kcomposer installs
1.1.3latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/columbiaroad/wp-ssr/archive/refs/heads/master.zip

On Packagist as columbiaroad/wp-ssr:

composer require columbiaroad/wp-ssr
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WordPress SSR

Poor man's Server Side Rendering

This application aims to solve server side rendering of JavaScript applications inside WordPress templates. It runs in two parts. First there is the WordPress plugin which creates new post type for the renders and REST API endpoints to get an array of render objects. Secondly there is Express server which when accessed fetches these render objects and launches puppeteer to render the pages. When the page is rendered and the wanted application part of that page is parsed, it will save the html back to the post through the REST API.

Disclaimer

This application doesn't provide you real time server side rendering but it's suitable for better SEO accessibility for your content. The puppeteer renders the page always as unauthenticated user and it requires that the state changes are reflected in the url.

Setup

WordPress

You can install the plugin using composer:

composer require "columbiaroad/wp-ssr:0.1.2@dev"

First you need to navigate to the plugin settings and fill in the required information. You need to provide an API key to be used for authenticating with the REST API. Then you need to give WordPress the Node application url what to ping for renders. Last you can define the interval when the renders expire.

In the WordPress template you need to request the rendered content before initial render of the header. You can request the content of the application by using WPSSR\Render::render method which takes in three parameters:

  • string $url Url of the page you are requesting to be rendered
  • string $app_selector Query selector for the application root element
  • string $waitfor_selector Query selector for the puppeteer to wait before rendering the page
<?php
/**
 * Template Name: React Application
 *
 */

$content = WPSSR\Render::render(
  get_permalink(),
  '#react-app-root', // App selector
  '#react-app-inner' // Waitfor selector
);

get_header();
?>

<div id="react-app-root">
  <?php echo $content; ?>
</div>

<?php get_footer(); ?>

Node App

To start the Node application you need to have couple of environment variables available for it.

  • WP_DOMAIN which points to the root of your WordPress installation
  • API_KEY is the same API key that you provided in the plugin settings page
  • NODE_ENV to define the Node environment. This is used in example to ignore puppeteer HTTPS errors
  • SCHEDULE to define the schedule for rendering cron job

One way to run the application is to use the Docker image provided:

docker run -d \
  -e "WP_DOMAIN=https://example.com" \
  -e "API_KEY=my-api-key" \
  -e "NODE_ENV=production" \
  -e "SCHEDULE=*/15 * * * *" \
  -p 80:3000 \
  --restart=unless-stoppped \
  --name=wpssr \
  columbiaroadcom/wp-ssr

Publishing package

The composer package is automatically published to columbiaroad/wp-ssr when a github release is made.

To publish to dockerhub you need access to the repository there. Publishing is done as follows:

docker build . --tag columbiaroadcom/wp-ssr:<tag>
docker push columbiaroadcom/wp-ssr:<tag>

TODO

  • [ ] Add .env file support for the Node application
  • [ ] Optimize for large amount of renders
  • [ ] Lock the rendering process to prevent multiple simultaneous render calls

Releases

8 releases.

Tag
Published
1.1.3 latest
Mar 31, 2021 5 years ago
Mar 21, 2021 5 years ago
Mar 15, 2021 5 years ago
Mar 9, 2021 5 years ago
Jun 17, 2020 6 years ago
Feb 19, 2020 6 years ago
Feb 14, 2020 6 years ago
Feb 12, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WP SSR 1.1.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.3
Findings
1
Worst severity
medium
Content hash
11cf0eb78c76eede0ca2c2bc…

Findings

  • medium Unmaintained GitHub plugin with no Update URI (last commit 2021)

    unmaintained

    Header version 1.1.3 matches git tag 1.1.3. The GitHub repo columbiaroad/wp-ssr has no commits after 2021-03-31, the plugin header has no Update URI (WordPress will not deliver updates), and the package is not on wordpress.org. The critical empty-key REST XSS above therefore has no in-tree maintainer or patch channel. The bundled companion (Dockerfile FROM node:13, npm start via nodemon, puppeteer --no-sandbox, lib/config.js console.logs API_KEY) is the same vintage. Operators who installed this for SEO SSR have a public HTML-injection sink and no vendor fix.

    wp-ssr.php:3-11

    Recommendation

    Do not run this plugin on production sites. Replace the SSR cache with a maintained approach, or fork and patch check_permission() / key generation before exposing the REST namespace. Add an Update URI only if a maintained fork will actually ship fixes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.