Ticket #39309: 39309_-_Updated_Patch_3.patch

wp-admin/includes/class-wp-upgrader.php

@@ -140 +140 @@
                 $this->generic_strings();
         }
 
+    /**
+     * Return an array of trusted Ed25519 public keys
+     *
+     * @return array<int, string>
+     */
+        public function getPublicKeys()
+    {
+        return array(
+            ParagonIE_Sodium_Compat::hex2bin( '4d6236cc44829b2f96a26d905aec92162077ef5aa7e0a4e2a6d251258dc83bd1' )
+        );
+    }
+
         /**
          * Add the generic strings to WP_Upgrader::$strings.
          *
@@ -275 +287 @@
 
                 $this->skin->feedback( 'downloading_package', $package );
 
-                $download_file = download_url( $package );
+                $download_file = download_url( $package, 300, self::getPublicKeys() );
 
                 if ( is_wp_error( $download_file ) ) {
                         return new WP_Error( 'download_failed', $this->strings['download_failed'], $download_file->get_error_message() );

wp-admin/includes/file.php

@@ -965 +965 @@
  *
  * @param string $url the URL of the file to download
  * @param int $timeout The timeout for the request to download the file default 300 seconds
+ * @param array<int, string> $publicKeys An array of strings containing Ed25519 public keys
  * @return mixed WP_Error on failure, string Filename on success.
  */
-function download_url( $url, $timeout = 300 ) {
+function download_url( $url, $timeout = 300, $publicKeys = array() ) {
         //WARNING: The file is not automatically deleted, The script must unlink() the file.
         if ( ! $url ) {
                 return new WP_Error( 'http_no_url', __( 'Invalid URL Provided.' ) );
@@ -1007 +1008 @@
                 }
         }
 
+    $content_ed25519_hex = wp_remote_retrieve_header( $response, 'content-ed25519' );
+    $ed25519_check = verify_file_ed25519( $tmpfname, $publicKeys, $content_ed25519_hex );
+    if ( is_wp_error( $ed25519_check ) ) {
+        unlink( $tmpfname );
+        return $ed25519_check;
+    }
+
         return $tmpfname;
 }
 
@@ -1896 +1904 @@
         </div>
         <?php
 }
+
+/**
+ * Verifies the Ed25519 signature of a file for a given set of public keys.
+ *
+ * @since 5.0 (presumably)
+ *
+ * @param string $filename
+ * @param array<int, string> $publicKeys
+ * @param string $signature
+ * @return bool|object WP_Error on failure, true on success
+ */
+function verify_file_ed25519( $filename, $publicKeys, $signature ) {
+    if ( ParagonIE_Sodium_Core_Util::strlen( $signature ) === ParagonIE_Sodium_Compat::CRYPTO_SIGN_BYTES * 2) {
+        $signature = ParagonIE_Sodium_Compat::hex2bin($signature);
+    }
+    foreach ($publicKeys as $public_key) {
+        if (ParagonIE_Sodium_Core_Util::strlen( $public_key ) === ParagonIE_Sodium_Compat::CRYPTO_SIGN_PUBLICKEYBYTES * 2) {
+            $public_key = ParagonIE_Sodium_Compat::hex2bin( $public_key );
+        }
+        if ( ParagonIE_Sodium_File::verify( $signature, $filename, $public_key ) ) {
+            return true;
+        }
+    }
+    return new WP_Error( 'ed25519_mismatch', sprintf( __( 'The signature of the file (%1$s) is not valid for any of the trusted public keys.' ), bin2hex( $signature ) ) );
+}