Changeset 59578

Timestamp:

01/06/2025 03:21:26 PM (2 weeks ago)

Author:

johnbillion

Message:

Security: Enhance the wp_hash() function to support custom hashing algorithms.

The default algorithm remains as md5, but this change allows any algorithm that's supported by hash_hmac() to be used instead.

Props pushpenderindia, ayeshrajans, debarghyabanerjee, johnbillion

Fixes #62005

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (1 diff)
• tests/phpunit/tests/functions/wpHash.php (added)
• tests/phpunit/tests/pluggable/signatures.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -2582 +2582 @@
 if ( ! function_exists( 'wp_hash' ) ) :
     /**
-     * Gets hash of given string.
+     * Gets the hash of the given string.
+     *
+     * The default algorithm is md5 but can be changed to any algorithm supported by
+     * `hash_hmac()`. Use the `hash_hmac_algos()` function to check the supported
+     * algorithms.
      *
      * @since 2.0.3
+     * @since 6.8.0 The `$algo` parameter was added.
+     *
+     * @throws InvalidArgumentException if the hashing algorithm is not supported.
      *
      * @param string $data   Plain text to hash.
      * @param string $scheme Authentication scheme (auth, secure_auth, logged_in, nonce).
+     * @param string $algo   Hashing algorithm to use. Default: 'md5'.
      * @return string Hash of $data.
      */
-    function wp_hash( $data, $scheme = 'auth' ) {
+    function wp_hash( $data, $scheme = 'auth', $algo = 'md5' ) {
         $salt = wp_salt( $scheme );
 
-        return hash_hmac( 'md5', $data, $salt );
+        // Ensure the algorithm is supported by the hash_hmac function.
+        if ( ! in_array( $algo, hash_hmac_algos(), true ) ) {
+            throw new InvalidArgumentException(
+                sprintf(
+                    /** translators: 1: Name of a cryptographic hash algorithm. 2: List of supported algorithms. */
+                    __( 'Unsupported hashing algorithm: %1$s. Supported algorithms are: %2$s' ),
+                    $algo,
+                    implode( ', ', hash_hmac_algos() )
+                )
+            );
+        }
+
+        return hash_hmac( $algo, $data, $salt );
     }
 endif;

trunk/tests/phpunit/tests/pluggable/signatures.php

@@ -210 +210 @@
                 'data',
                 'scheme' => 'auth',
+                'algo'   => 'md5',
             ),
             'wp_hash_password'                => array( 'password' ),