T129506_01_Math_REL1_25.patch
dpatrick (Darian Anthony Patrick)
Actions

Authored By

	• dpatrick
	Apr 29 2016, 11:52 PM

Size

1 KB

Referenced Files

None

Subscribers

None

T129506_01_Math_REL1_25.patch
View Options

	From 6c7587ae29653ec30b7bbba23024ca9cb7eea0ab Mon Sep 17 00:00:00 2001
	From: Darian Anthony Patrick <dpatrick@wikimedia.org>
	Date: Mon, 25 Apr 2016 10:57:57 -0700
	Subject: [PATCH] Skip shell invocation on large input

	Add a sanity check to the math extension that skips shelling out to
	texvc if the input is insanely large.

	Bug: T129506
	Change-Id: Ifb697a33f07aea72a8a7eb7ed1499d144872b206
	---
	MathInputCheckTexvc.php \| 5 +++++
	MathTexvc.php \| 5 +++++
	2 files changed, 10 insertions(+)

	diff --git a/MathInputCheckTexvc.php b/MathInputCheckTexvc.php
	index 5845a7d..bd7de73 100644
	--- a/MathInputCheckTexvc.php
	+++ b/MathInputCheckTexvc.php
	@@ -77,6 +77,11 @@ class MathInputCheckTexvc extends MathInputCheck {
	}

	LoggerFactory::getInstance( 'Math' )->debug( "TeX check command: $cmd" );
	+ if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) {
	+ LoggerFactory::getInstance( 'Math' )->error(
	+ "User input exceeded SHELL_MAX_ARG_STRLEN." );
	+ return $this->convertTexvcError('');
	+ }
	$contents = wfShellExec( $cmd );
	LoggerFactory::getInstance( 'Math' )->debug( "TeX check result: $contents\n---" );

	diff --git a/MathTexvc.php b/MathTexvc.php
	index 70f351c..1d2fc41 100644
	--- a/MathTexvc.php
	+++ b/MathTexvc.php
	@@ -201,6 +201,11 @@ class MathTexvc extends MathRenderer {
	LoggerFactory::getInstance( 'Math' )->debug( "TeX: $cmd" );
	LoggerFactory::getInstance( 'Math' )->debug( "Executing '$cmd'." );
	$retval = null;
	+ if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) {
	+ LoggerFactory::getInstance( 'Math' )->error(
	+ "User input exceeded SHELL_MAX_ARG_STRLEN." );
	+ return $this->getError( 'math_unknown_error' );
	+ }
	$contents = wfShellExec( $cmd, $retval );
	LoggerFactory::getInstance( 'Math' )->debug( "TeX output:\n $contents\n---" );

	--
	2.5.4 (Apple Git-61)

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3687986
Default Alt Text: T129506_01_Math_REL1_25.patch (1 KB)

Attached To	Mode
T124940: MediaWiki 1.26.3 security release	Attached	Detach File
T129506: MediaWiki:Gadget-popups.js isn't renderable	Attached	Detach File

T129506_01_Math_REL1_25.patchdpatrick (Darian Anthony Patrick)Actions

T129506_01_Math_REL1_25.patchView Options

File Metadata

Event Timeline

T129506_01_Math_REL1_25.patch
dpatrick (Darian Anthony Patrick)
Actions

T129506_01_Math_REL1_25.patch
View Options