From e2e89e5b1f5989f1d706efe0eb4449f8c1eec529 Mon Sep 17 00:00:00 2001 From: Shawn Hooper Date: Fri, 10 Nov 2023 15:33:03 -0500 Subject: [PATCH 1/3] Add edge case handling for Hello Dolly (Core vs Plugin) --- features/checksum-plugin.feature | 9 +++++++++ src/Checksum_Plugin_Command.php | 13 ++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/features/checksum-plugin.feature b/features/checksum-plugin.feature index 7e754741..d37b1aa0 100644 --- a/features/checksum-plugin.feature +++ b/features/checksum-plugin.feature @@ -215,3 +215,12 @@ Feature: Validate checksums for WordPress plugins """ Verified 1 of 1 plugins. """ + + Scenario: Verifies Hello Dolly + Given a WP install + + When I run `wp plugin verify-checksums hello` + Then STDOUT should contain: + """ + Verified 1 of 1 plugins. + """ diff --git a/src/Checksum_Plugin_Command.php b/src/Checksum_Plugin_Command.php index 99a8b942..b9dbcb46 100644 --- a/src/Checksum_Plugin_Command.php +++ b/src/Checksum_Plugin_Command.php @@ -113,8 +113,13 @@ public function __invoke( $args, $assoc_args ) { $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); + $plugin_name = $plugin->name; + if ( 'hello' === $plugin_name ) { + $plugin_name = 'hello-dolly'; + } + try { - $checksums = $wp_org_api->get_plugin_checksums( $plugin->name, $version ); + $checksums = $wp_org_api->get_plugin_checksums( $plugin_name, $version ); } catch ( Exception $exception ) { WP_CLI::warning( $exception->getMessage() ); $checksums = false; @@ -129,6 +134,10 @@ public function __invoke( $args, $assoc_args ) { $files = $this->get_plugin_files( $plugin->file ); foreach ( $checksums as $file => $checksum_array ) { + if ( $plugin->name === 'hello' && $file !== 'hello.php') { + continue; + } + if ( ! in_array( $file, $files, true ) ) { $this->add_error( $plugin->name, $file, 'File is missing' ); } @@ -143,7 +152,6 @@ public function __invoke( $args, $assoc_args ) { if ( ! $strict && $this->is_soft_change_file( $file ) ) { continue; } - $result = $this->check_file_checksum( dirname( $plugin->file ) . '/' . $file, $checksums[ $file ] ); if ( true !== $result ) { $this->add_error( $plugin->name, $file, is_string( $result ) ? $result : 'Checksum does not match' ); @@ -255,7 +263,6 @@ private function check_file_checksum( $path, $checksums ) { && array_key_exists( 'sha256', $checksums ) ) { $sha256 = $this->get_sha256( $this->get_absolute_path( $path ) ); - return in_array( $sha256, (array) $checksums['sha256'], true ); } From 95592120af458cf0a924fa53e355ab426f23e3f0 Mon Sep 17 00:00:00 2001 From: Shawn Hooper Date: Fri, 10 Nov 2023 16:31:41 -0500 Subject: [PATCH 2/3] Compare hello.php against core checksum instead of plugin repo --- src/Checksum_Plugin_Command.php | 39 ++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 10 deletions(-) diff --git a/src/Checksum_Plugin_Command.php b/src/Checksum_Plugin_Command.php index b9dbcb46..73bfbb12 100644 --- a/src/Checksum_Plugin_Command.php +++ b/src/Checksum_Plugin_Command.php @@ -105,6 +105,11 @@ public function __invoke( $args, $assoc_args ) { continue; } + if ( 'hello' === $plugin->name ) { + $this->verify_hello_dolly_from_core($assoc_args); + continue; + } + if ( false === $version ) { WP_CLI::warning( "Could not retrieve the version for plugin {$plugin->name}, skipping." ); ++$skips; @@ -113,13 +118,8 @@ public function __invoke( $args, $assoc_args ) { $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); - $plugin_name = $plugin->name; - if ( 'hello' === $plugin_name ) { - $plugin_name = 'hello-dolly'; - } - try { - $checksums = $wp_org_api->get_plugin_checksums( $plugin_name, $version ); + $checksums = $wp_org_api->get_plugin_checksums( $plugin->name, $version ); } catch ( Exception $exception ) { WP_CLI::warning( $exception->getMessage() ); $checksums = false; @@ -134,10 +134,6 @@ public function __invoke( $args, $assoc_args ) { $files = $this->get_plugin_files( $plugin->file ); foreach ( $checksums as $file => $checksum_array ) { - if ( $plugin->name === 'hello' && $file !== 'hello.php') { - continue; - } - if ( ! in_array( $file, $files, true ) ) { $this->add_error( $plugin->name, $file, 'File is missing' ); } @@ -181,6 +177,29 @@ public function __invoke( $args, $assoc_args ) { ); } + private function verify_hello_dolly_from_core($assoc_args) { + $file = 'hello.php'; + $wp_version = get_bloginfo( 'version', 'display' ); + $insecure = (bool) Utils\get_flag_value( $assoc_args, 'insecure', false ); + $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); + $locale = ''; + + try { + $checksums = $wp_org_api->get_core_checksums( $wp_version, empty( $locale ) ? 'en_US' : $locale ); + } catch ( Exception $exception ) { + WP_CLI::error( $exception ); + } + + if ( ! is_array( $checksums ) || !isset($checksums['wp-content/plugins/hello.php'] ) ) { + WP_CLI::error( "Couldn't get hello.php checksum from WordPress.org." ); + } + + $md5_file = md5_file( $this->get_absolute_path('/') . $file ); + if ( $md5_file !== $checksums['wp-content/plugins/hello.php'] ) { + $this->add_error( 'hello', $file, 'Checksum does not match' ); + } + } + /** * Adds a new error to the array of detected errors. * From fe3a445663bea57cef4dc71ac39156802f116325 Mon Sep 17 00:00:00 2001 From: Shawn Hooper Date: Fri, 10 Nov 2023 16:37:49 -0500 Subject: [PATCH 3/3] Fixed PHPCS Linting errors --- src/Checksum_Plugin_Command.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/Checksum_Plugin_Command.php b/src/Checksum_Plugin_Command.php index 73bfbb12..d35c82a6 100644 --- a/src/Checksum_Plugin_Command.php +++ b/src/Checksum_Plugin_Command.php @@ -106,7 +106,7 @@ public function __invoke( $args, $assoc_args ) { } if ( 'hello' === $plugin->name ) { - $this->verify_hello_dolly_from_core($assoc_args); + $this->verify_hello_dolly_from_core( $assoc_args ); continue; } @@ -177,12 +177,12 @@ public function __invoke( $args, $assoc_args ) { ); } - private function verify_hello_dolly_from_core($assoc_args) { - $file = 'hello.php'; + private function verify_hello_dolly_from_core( $assoc_args ) { + $file = 'hello.php'; $wp_version = get_bloginfo( 'version', 'display' ); - $insecure = (bool) Utils\get_flag_value( $assoc_args, 'insecure', false ); + $insecure = (bool) Utils\get_flag_value( $assoc_args, 'insecure', false ); $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); - $locale = ''; + $locale = ''; try { $checksums = $wp_org_api->get_core_checksums( $wp_version, empty( $locale ) ? 'en_US' : $locale ); @@ -190,11 +190,11 @@ private function verify_hello_dolly_from_core($assoc_args) { WP_CLI::error( $exception ); } - if ( ! is_array( $checksums ) || !isset($checksums['wp-content/plugins/hello.php'] ) ) { + if ( ! is_array( $checksums ) || ! isset( $checksums['wp-content/plugins/hello.php'] ) ) { WP_CLI::error( "Couldn't get hello.php checksum from WordPress.org." ); } - $md5_file = md5_file( $this->get_absolute_path('/') . $file ); + $md5_file = md5_file( $this->get_absolute_path( '/' ) . $file ); if ( $md5_file !== $checksums['wp-content/plugins/hello.php'] ) { $this->add_error( 'hello', $file, 'Checksum does not match' ); }