Changeset 64529

Timestamp:

11/10/2026 04:00:02 PM (7 hours ago)

Author:

whyisjake

Message:

Security: Make the Secrets API extension points abstract classes.

WP_Secrets_Provider, WP_Secrets_Store and WP_Secrets_Keyring were interfaces. Once they ship, adding a method to one would be a fatal error in every secrets.php drop-in that implements it, so they could never change. As abstract classes, a later release can add a method with a default implementation and existing drop-ins keep working.

The method signatures are unchanged. The three files are renamed from interface-wp-secrets-*.php to class-wp-secrets-*.php, and the default and fail-closed implementations now extend the classes.

A drop-in written against the interfaces must change implements to extends. Until it does, loading it is a fatal error.

Follow-up to r64337, r65375.

Props ericmann, jorbin.
See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65390

Location:

trunk

Files:

• wp-includes/load.php (modified) (2 diffs)
• wp-includes/secrets/class-wp-secrets-broken-keyring.php (modified) (1 diff)
• wp-includes/secrets/class-wp-secrets-broken-provider.php (modified) (1 diff)
• wp-includes/secrets/class-wp-secrets-broken-store.php (modified) (1 diff)
• wp-includes/secrets/class-wp-secrets-config-key-provider.php (modified) (1 diff)
• wp-includes/secrets/class-wp-secrets-keyring.php (added)
• wp-includes/secrets/class-wp-secrets-libsodium-provider.php (modified) (2 diffs)
• wp-includes/secrets/class-wp-secrets-option-store.php (modified) (1 diff)
• wp-includes/secrets/class-wp-secrets-provider.php (added)
• wp-includes/secrets/class-wp-secrets-store.php (added)
• wp-includes/secrets/interface-wp-secrets-keyring.php (deleted)
• wp-includes/secrets/interface-wp-secrets-provider.php (deleted)
• wp-includes/secrets/interface-wp-secrets-store.php (deleted)
• wp-includes/version.php (modified) (1 diff)
• wp-settings.php (modified) (1 diff)

trunk/wp-includes/load.php

@@ -829 +829 @@
  * Secrets API's provider, store, and keyring overrides in a usable state.
  *
- * Runs once, before must-use plugins load, so that every interface a drop-in's
- * classes implement already exists and every plugin sees the drop-in's provider.
+ * Runs once, before must-use plugins load, so that every class a drop-in's classes
+ * extend already exists and every plugin sees the drop-in's provider.
  *
  * The drop-in sets its overrides in the `$wp_secrets_provider`, `$wp_secrets_store`
@@ -842 +842 @@
  * Sets `$GLOBALS['wp_secrets_dropin_broken']` when the require throws, or when any of
  * `$GLOBALS['wp_secrets_provider']`, `$GLOBALS['wp_secrets_store']`, or
- * `$GLOBALS['wp_secrets_keyring']` is set to something that does not implement its
- * interface. A global left unset is fine: a drop-in that overrides only the keyring
+ * `$GLOBALS['wp_secrets_keyring']` is set to something that does not extend its
+ * class. A global left unset is fine: a drop-in that overrides only the keyring
  * leaves the other two alone. Once the flag is set, every Secrets API operation
  * returns WP_Error for the rest of the request rather than falling back to the
  * default provider, so a broken drop-in reads as unreachable, never as absent.
  *
- * PHP treats a class that implements an interface but omits a required method as an
- * uncatchable fatal error, even inside the try/catch around the require. That case
+ * PHP treats a class that extends an abstract class but omits one of its abstract
+ * methods as an uncatchable fatal error, even inside the try/catch around the require. That case
  * cannot be intercepted from PHP code.
  *

trunk/wp-includes/secrets/class-wp-secrets-broken-keyring.php

@@ -21 +21 @@
  * @since 7.2.0
  */
-final class WP_Secrets_Broken_Keyring implements WP_Secrets_Keyring {
+final class WP_Secrets_Broken_Keyring extends WP_Secrets_Keyring {
 
         /**

trunk/wp-includes/secrets/class-wp-secrets-broken-provider.php

@@ -23 +23 @@
  * @since 7.2.0
  */
-final class WP_Secrets_Broken_Provider implements WP_Secrets_Provider {
+final class WP_Secrets_Broken_Provider extends WP_Secrets_Provider {
 
         /**

trunk/wp-includes/secrets/class-wp-secrets-broken-store.php

@@ -22 +22 @@
  * @since 7.2.0
  */
-final class WP_Secrets_Broken_Store implements WP_Secrets_Store {
+final class WP_Secrets_Broken_Store extends WP_Secrets_Store {
 
         /**

trunk/wp-includes/secrets/class-wp-secrets-config-key-provider.php

@@ -39 +39 @@
  * @since 7.2.0
  */
-final class WP_Secrets_Config_Key_Provider implements WP_Secrets_Keyring {
+final class WP_Secrets_Config_Key_Provider extends WP_Secrets_Keyring {
 
         /**

trunk/wp-includes/secrets/class-wp-secrets-libsodium-provider.php

@@ -14 +14 @@
  *
  * This is the default rather than a privileged case. Everything it does is expressed
- * through WP_Secrets_Provider, the same interface a platform implements, so a KMS-
+ * through WP_Secrets_Provider, the same class a platform extends, so a KMS-
  * or HSM-backed provider is a peer rather than an exception carved into the side of
  * this one.
@@ -33 +33 @@
  * @since 7.2.0
  */
-final class WP_Secrets_Libsodium_Provider implements WP_Secrets_Provider {
+final class WP_Secrets_Libsodium_Provider extends WP_Secrets_Provider {
 
         /**

trunk/wp-includes/secrets/class-wp-secrets-option-store.php

@@ -22 +22 @@
  * @since 7.2.0
  */
-final class WP_Secrets_Option_Store implements WP_Secrets_Store {
+final class WP_Secrets_Option_Store extends WP_Secrets_Store {
 
         /**

trunk/wp-includes/version.php

@@ -17 +17 @@
  * @global string $wp_version
  */
-$wp_version = '7.2-beta4-65389';
+$wp_version = '7.2-beta4-65390';
 
 /**

trunk/wp-settings.php

@@ -325 +325 @@
 require ABSPATH . WPINC . '/secrets/class-wp-secret-version.php';
 require ABSPATH . WPINC . '/secrets/class-wp-secret.php';
-require ABSPATH . WPINC . '/secrets/interface-wp-secrets-provider.php';
-require ABSPATH . WPINC . '/secrets/interface-wp-secrets-keyring.php';
-require ABSPATH . WPINC . '/secrets/interface-wp-secrets-store.php';
+require ABSPATH . WPINC . '/secrets/class-wp-secrets-provider.php';
+require ABSPATH . WPINC . '/secrets/class-wp-secrets-keyring.php';
+require ABSPATH . WPINC . '/secrets/class-wp-secrets-store.php';
 require ABSPATH . WPINC . '/secrets/class-wp-secrets-config-key-provider.php';
 require ABSPATH . WPINC . '/secrets/class-wp-secrets-broken-keyring.php';