Page MenuHomePhabricator

Remove the useless "may contain malicious content" warning on some uploaded files
Open, Needs TriagePublic

Description

The "may contain malicious content" warning on some file types is useless -- it doesn't indicate any actual danger, and its absence doesn't indicate the lack of danger in any meaningful way either.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

I'm not sure if it's entirely meaningless. It just means that MediaWiki knows nothing about the file type. We don't display it fr known image, audio and video formats. For the two tasks you merged, I think it'd be better to just add those formats to the whitelist ($wgTrustedMediaFormats).

.mov is not actually recognized as a video format at all. I think we need to add 'video/quicktime' in includes/libs/mime/mime.info.

.txt is probably intentionally not listed there because of old IE content detection (it ignores the Content-Type if it specifies text/plain and looks at the contents, and may decide to treat it as HTML with JS code for example).

Immediately after uploading via the IA-Uploader, the page (https://commons.wikimedia.org/wiki/File:Third_Report_on_the_State_of_Education_in_Bengal.djvu) displays the following message

'Third_Report_on_the_State_of_Education_in_Bengal.djvu ‎(0 × 0 pixels, file size: 10.85 MB, MIME type: image/vnd.djvu)
Warning: This file type may contain malicious code. By executing it, your system may be compromised. '

But after clicking on the 'Discussion' tab, then 'Start a discussion', 'Cancel' and finally, the 'File' tab, normalcy is restored i.e. one can see the first page of the pdf followed by 'Original file ‎(3,450 × 5,767 pixels, file size: 10.85 MB, MIME type: image/vnd.djvu, 252 pages) '

Clicking on 'File:Third Report on the State of Education in Bengal.djvu' in the section 'File usage on Commons' brings the problem back again.

Maybe should just be limited just to executable files