Changeset 45345 for trunk/src/wp-admin/includes/file.php

Timestamp:

05/17/2019 11:05:45 AM (6 years ago)

Author:

tellyworth

Message:

Upgrade/Install: Don't run signature verify on slow 32-bit systems.

The sodium_compat library can be very slow for certain operations on 32-bit architectures, which can lead to web server timeouts while attempting to verify an update. This adds a runtime speed check to skip signature verification on systems that would otherwise time out. Includes simple unit tests.

Props dd32, paragoninitiativeenterprises.
See #47186.

File:

• trunk/src/wp-admin/includes/file.php (modified) (1 diff)

trunk/src/wp-admin/includes/file.php

@@ -1200 +1200 @@
     }
 
+    // Verify runtime speed of Sodium_Compat is acceptable.
+    if ( ! extension_loaded( 'sodium' ) && ! ParagonIE_Sodium_Compat::polyfill_is_fast() ) {
+        $sodium_compat_is_fast = false;
+
+        // Allow for an old version of Sodium_Compat being loaded before the bundled WordPress one.
+        if ( method_exists( 'ParagonIE_Sodium_Compat', 'runtime_speed_test' ) ) {
+            // Run `ParagonIE_Sodium_Compat::runtime_speed_test()` in optimized integer mode, as that's what WordPress utilises during signing verifications.
+            $old_fastMult                      = ParagonIE_Sodium_Compat::$fastMult;
+            ParagonIE_Sodium_Compat::$fastMult = true;
+            $sodium_compat_is_fast             = ParagonIE_Sodium_Compat::runtime_speed_test( 100, 10 );
+            ParagonIE_Sodium_Compat::$fastMult = $old_fastMult;
+        }
+
+        // This cannot be performed in a reasonable amount of time
+        // https://github.com/paragonie/sodium_compat#help-sodium_compat-is-slow-how-can-i-make-it-fast
+        if ( ! $sodium_compat_is_fast ) {
+            return new WP_Error(
+                'signature_verification_unsupported',
+                sprintf(
+                    /* translators: 1: The filename of the package. */
+                    __( 'The authenticity of %1$s could not be verified as signature verification is unavailable on this system.' ),
+                    '<span class="code">' . esc_html( $filename_for_errors ) . '</span>'
+                ),
+                array(
+                    'php'                => phpversion(),
+                    'sodium'             => defined( 'SODIUM_LIBRARY_VERSION' ) ? SODIUM_LIBRARY_VERSION : ( defined( 'ParagonIE_Sodium_Compat::VERSION_STRING' ) ? ParagonIE_Sodium_Compat::VERSION_STRING : false ),
+                    'polyfill_is_fast'   => false,
+                    'max_execution_time' => ini_get( 'max_execution_time' ),
+                )
+            );
+        }
+    }
+
     if ( ! $signatures ) {
         return new WP_Error(