| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
| |
CVE-2024-PENDING
A malicious editor could potentially create an edit summary or log
summary with links such that a link marker is in an attribute which
will then get replaced allowing the content to break out of the
attribute leading to an XSS.
Bug: T355538
Change-Id: If20a8a95e84bb2f6e132bdda4907e3db6f133a8e
|
| |
|
|
|
|
|
|
|
|
|
| |
This is mostly about adding return types to methods that implement PHP
interfaces, and not passing null to core functions that want a string.
After this patch, and an update to return types in RemexHtml,
tests/phpunit/integration/ has no more errors than in PHP 8.0.
Bug: T289879
Bug: T289926
Change-Id: Ia424f5cc897070f4188ae126b5bf6a1f552db0e1
|
| |
|
|
|
|
|
|
|
| |
Make phan stricter about conditional variable declaration
Remaining false positive issues are suppressed.
The suppression and the setting change can only be done together
Bug: T259172
Change-Id: I1f200ac37df7448453688bf464a8250c97313e5d
|
| |
|
|
|
|
|
|
|
|
|
| |
Make phan stricter about array keys
Remaining false positive issues are suppressed.
The suppression and the setting change can only be done together
Bug: T304887
Depends-On: I3105a5fd4826f8667b5232834defc5ec93be32a1
Depends-On: Ie9610a6e83731468311edb3ed17f80fc509de385
Change-Id: I701f12ab94478c3b8e7fd82110ade74a8e6b04ef
|
| |
|
|
|
|
|
|
|
|
|
| |
Make phan stricter about null types by setting null_casts_as_any_type to
false (the default in mediawiki-phan-config)
Remaining false positive issues are suppressed.
The suppression and the setting change can only be done together
Bug: T242536
Bug: T301991
Change-Id: I0f295382b96fb3be8037a01c10487d9d591e7e01
|
| |
|
|
|
|
|
|
| |
Also check for false if needed
Found by phan strict checks
Change-Id: I298204653dfb788515a87978dd8705b6e4f9c775
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Some functions accept only string, cast ints and floats to string
* After preg_matches or explode() casts numbers to int to do maths
* Cast unix timestamps to int to do maths
* Cast return values from timestamp format function to int
* Cast bitwise operator to bool when needed as bool
* php internal functions like floor/round/ceil documented to return
float, most cases the result is used as int, added casts
Found by phan strict checks
Change-Id: Icb2de32107f43817acc45fe296fb77acf65c1786
|
| |
|
|
|
|
|
|
|
|
| |
Check the more common case (local cached title) first, before
calling isAlwaysKnown which can be expensive due to hooks.
Follows-up Ica8733fb4a890fd2d2fc37eb85657c3715805133.
Bug: T293665
Change-Id: I8eb6144a3f1de5ebf9b4bd44e4021f9b6837f442
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Existence of global userpages (or similar nonlocal pages) can only be
known if the relevant title hook is involved, but LinkBatch is caching
these pages as bad links immediately after querying the local database.
CommentParser is then relying on this information to treat them as
always bad; thus preempting any further checks that might be done by
LinkRenderer to properly account for their magical existence.
Now title always-known status will be checked, to preempt bad linking.
Bug: T293665
Change-Id: Ica8733fb4a890fd2d2fc37eb85657c3715805133
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* In LinkBatch::addObj(), reject interwiki links with a warning.
Otherwise the link is added to the batch by ns/title and later
reconstructed as if it were a local link without an interwiki
prefix.
* In CommentParser, treat interwiki links as always good, don't defer
the existence check.
* In LinkBatch, inject a LoggerInstance instead of calling LoggerFactory
in four places.
* Add a regression test, and some general tests for known links.
Bug: T300311
Change-Id: I0e5825eb48a6ba2932aea69a4d0fff3439c50ff5
|
| |
|
|
|
|
| |
For better tracking of db queries
Change-Id: Idad72d0dabb2ff1684189bf958d14aaa8b3c08ab
|
| |
|
|
|
| |
Bug: T254646
Change-Id: Ia660ab95353cd8f05c50e60f30d29fd22b018a43
|
| |
|
|
|
| |
Bug: T292590
Change-Id: I8f830183c6deeb8bea146f1c1b791722a384220c
|
|
|
CommentParser:
* Move comment formatting backend from Linker to a CommentParser service.
Allow link existence and file existence to be batched.
* Rename $local to $samePage since I think that is clearer.
* Rename $title to $selfLinkTarget since it was unclear what the title
was used for.
* Rename the "autocomment" concept to "section link" in public
interfaces, although the old term remains in CSS classes.
* Keep unsafe HTML pass-through in separate "unsafe" methods, for easier
static analysis and code review.
CommentFormatter:
* Add CommentFormatter and RowCommentFormatter services as a usable
frontend for comment batches, and to replace the Linker static methods.
* Provide fluent and parametric interfaces.
Linker:
* Remove Linker::makeCommentLink() without deprecation -- nothing calls
it and it is obviously an internal helper.
* Soft-deprecate Linker methods formatComment(), formatLinksInComment(),
commentBlock() and revComment().
Caller migration:
* CommentFormatter single: Linker, RollbackAction, ApiComparePages,
ApiParse
* CommentFormatter parametric batch: ImageHistoryPseudoPager
* CommentFormatter fluent batch: ApiQueryFilearchive
* RowCommentFormatter sequential: History feed, BlocklistPager,
ProtectedPagesPager, ApiQueryProtectedTitles
* RowCommentFormatter with index: ChangesFeed, ChangesList,
ApiQueryDeletedrevs, ApiQueryLogEvents, ApiQueryRecentChanges
* RevisionCommentBatch: HistoryPager, ContribsPager
Bug: T285917
Change-Id: Ia3fd50a4a13138ba5003d884962da24746d562d0
|
