CHKPLUG: Checking GDPR Compliance of WordPress Plugins via Cross-language Code Property Graph
Faysal Hossain Shezan, Zihao Su, Mingqing Kang, Nicholas Phair, Patrick Thomas, Michelangelo van Dam, Yinzhi Cao, Yuan Tian · 2023
personally identifiable information (PII), which is regulated by privacy laws such as the European Union-introduced General Data Protection Regulation (GDPR).These plugins are published in the global App market and can be accessed or integrated by anyone around the world using the WordPress store.That is unless they specifically block EU traffic, it is the default assumption that they will have potential European Union traffic [32] and need to obey GDPR.An existing article [32] shows that it is the site owner's responsibility to ensure all the plugins installed on their website follow GDPR.Compliance with GDPR will help plugin developers to increase possible installations of their plugins.Plugin developers often are not familiar with privacy laws and therefore the need for an automatic checker is increasing for both plugin developers and website owners using these plugins.Ground-truth evaluation on 200 plugins shows that our tool achieves a 98.8% TNR (true negative rate) and a 89.3% TPR (true positive rate) for detecting violations of P access , P delete , P share and P security .To understand the current compliance situation of plugins, we perform a measurement analysis and run CHKPLUG on 2,722 plugins from the marketplace (Section IV).CHKPLUG determined 381 plugins (14%) to be non-compliant with GDPR regulations (Section V-C).Among them 368 plugins violate P delete , 19 plugins violate P share , and 36 plugins violate P security .We find no violations for P access because most of the time the plugins store PII data using WordPress core database, and the rest of the time they provide export functionality. Contribution.We make the following contributions in designing and implementing CHKPLUG. 1 In this paper, we refer to data access as Paccess, data deletion as P delete , data sharing as P share , and security of PII as P security Inter Language Edge Connector Dataflow Traversal