Context Navigation

← Previous Change
Next Change →

Ssl.php

Timestamp:

11/25/2021 01:10:30 AM (5 years ago)

Author:

SergeyBiryukov

Message:

External Libraries: Update the Requests library to version 2.0.0.

This is a major release and contains breaking changes.

Most important changes to be aware of for this release:

All code is now namespaced. Though there is a full backward compatibility layer available and the old class names are still supported, using them will generate a deprecation notice (which can be silenced by plugins if they'd need to support multiple WP versions). See the upgrade guide for more details.
A lot of classes have been marked final. This should generally not affect userland code as care has been taken to not apply the final keyword to classes which are known to be extended in userland code.
Extensive input validation has been added to Requests. When Requests is used as documented though, this will be unnoticable.
A new WpOrg\Requests\Requests::has_capabilities() method has been introduced which can be used to address #37708.
A new WpOrg\Requests\Response::decode_body() method has been introduced which may be usable to simplify some of the WP native wrapper code.
Remaining PHP 8.0 compatibility fixed (support for named parameters).
PHP 8.1 compatibility.

Release notes: https://github.com/WordPress/Requests/releases/tag/v2.0.0

For a full list of changes in this update, see the Requests GitHub:
https://github.com/WordPress/Requests/compare/v1.8.1...v2.0.0

Follow-up to [50842], [51078].

Props jrf, schlessera, datagutten, wojsmol, dd32, dustinrue, soulseekah, costdev, szepeviktor.
Fixes #54504.

File:

: 1 moved

trunk/src/wp-includes/Requests/Ssl.php (moved) (moved from trunk/src/wp-includes/Requests/SSL.php ) (7 diffs)

Legend:

: Unmodified
: Added
: Removed

trunk/src/wp-includes/Requests/Ssl.php

-              r52243
+              r52244
  * SSL utilities for Requests
+ *
+ * @package Requests
+ * @subpackage Utilities
+ * @package Requests\Utilities
  */
+namespace WpOrg\Requests;
+use WpOrg\Requests\Exception\InvalidArgument;
+use WpOrg\Requests\Utility\InputValidator;
 /**
 …
  * Collection of utilities for working with and verifying SSL certificates.
+ *
+ * @package Requests
+ * @subpackage Utilities
+ * @package Requests\Utilities
  */
 class Requests_SSL {
+final class Ssl {
         /**
          * Verify the certificate against common name and subject alternative names
 …
          * names, leading things like 'https://www.github.com/' to be invalid.
+         *
          * @see https://tools.ietf.org/html/rfc2818#section-3.1 RFC2818, Section 3.1
+         * @link https://tools.ietf.org/html/rfc2818#section-3.1 RFC2818, Section 3.1
+         *
+         * @throws Requests_Exception On not obtaining a match for the host (`fsockopen.ssl.no_match`)
+         * @param string $host Host name to verify against
+         * @param string|Stringable $host Host name to verify against
          * @param array $cert Certificate data from openssl_x509_parse()
          * @return bool
+         * @throws \WpOrg\Requests\Exception\InvalidArgument When the passed $host argument is not a string or a stringable object.
+         * @throws \WpOrg\Requests\Exception\InvalidArgument When the passed $cert argument is not an array or array accessible.
          */
         public static function verify_certificate($host, $cert) {
+                if (InputValidator::is_string_or_stringable($host) === false) {
+                        throw InvalidArgument::create(1, '$host', 'string|Stringable', gettype($host));
+                }
+                if (InputValidator::has_array_access($cert) === false) {
+                        throw InvalidArgument::create(2, '$cert', 'array|ArrayAccess', gettype($cert));
+                }
                 $has_dns_alt = false;
                 // Check the subjectAltName
                 if (!empty($cert['extensions']) && !empty($cert['extensions']['subjectAltName'])) {
+                if (!empty($cert['extensions']['subjectAltName'])) {
                         $altnames = explode(',', $cert['extensions']['subjectAltName']);
                         foreach ($altnames as $altname) {
 …
+                                }
+                        }
+                        if ($has_dns_alt === true) {
+                                return false;
+                        }
+                }
                 // Fall back to checking the common name if we didn't get any dNSName
                 // alt names, as per RFC2818
                 if (!$has_dns_alt && !empty($cert['subject']['CN'])) {
+                if (!empty($cert['subject']['CN'])) {
                         // Check for a match
+                        if (self::match_domain($host, $cert['subject']['CN']) === true) {
+                                return true;
+                        }
+                        return (self::match_domain($host, $cert['subject']['CN']) === true);
+                }
 …
          * the third rule.
+         *
          * @param string $reference Reference dNSName
+         * @param string|Stringable $reference Reference dNSName
          * @return boolean Is the name valid?
+         * @throws \WpOrg\Requests\Exception\InvalidArgument When the passed argument is not a string or a stringable object.
          */
         public static function verify_reference_name($reference) {
+                if (InputValidator::is_string_or_stringable($reference) === false) {
+                        throw InvalidArgument::create(1, '$reference', 'string|Stringable', gettype($reference));
+                }
+                if ($reference === '') {
+                        return false;
+                }
+                if (preg_match('`\s`', $reference) > 0) {
+                        // Whitespace detected. This can never be a dNSName.
+                        return false;
+                }
                 $parts = explode('.', $reference);
+                if ($parts !== array_filter($parts)) {
+                        // DNSName cannot contain two dots next to each other.
+                        return false;
+                }
                 // Check the first part of the name
 …
          * Match a hostname against a dNSName reference
+         *
          * @param string $host Requested host
          * @param string $reference dNSName to match against
+         * @param string|Stringable $host Requested host
+         * @param string|Stringable $reference dNSName to match against
          * @return boolean Does the domain match?
+         * @throws \WpOrg\Requests\Exception\InvalidArgument When either of the passed arguments is not a string or a stringable object.
          */
         public static function match_domain($host, $reference) {
+                if (InputValidator::is_string_or_stringable($host) === false) {
+                        throw InvalidArgument::create(1, '$host', 'string|Stringable', gettype($host));
+                }
                 // Check if the reference is blocklisted first
                 if (self::verify_reference_name($reference) !== true) {
 …
                 // Check for a direct match
                 if ($host === $reference) {
+                if ((string) $host === (string) $reference) {
                         return true;
+                }
                 // Calculate the valid wildcard match if the host is not an IP address
+                // Also validates that the host has 3 parts or more, as per Firefox's
+                // ruleset.
+                // Also validates that the host has 3 parts or more, as per Firefox's ruleset,
+                // as a wildcard reference is only allowed with 3 parts or more, so the
+                // comparison will never match if host doesn't contain 3 parts or more as well.
                 if (ip2long($host) === false) {
                         $parts    = explode('.', $host);
                         $parts[0] = '*';
                         $wildcard = implode('.', $parts);
                         if ($wildcard === $reference) {
+                        if ($wildcard === (string) $reference) {
                                 return true;
+                        }

Note: See TracChangeset for help on using the changeset viewer.

Make WordPress Core

Context Navigation

Changeset 52244 for trunk/src/wp-includes/Requests/Ssl.php

Legend:

trunk/src/wp-includes/Requests/Ssl.php

Download in other formats: