HomePhabricator

Restore backwards compatibility with injection-style grouping property

Tags
None
Referenced Files
None
Subscribers
None

Description

Restore backwards compatibility with injection-style grouping property

We initially set out to group by a single property,
so the template would take a property ID as parameter (eg P131)
and we would insert that in the SPARQL query with the correct wdt: prefix..

Users wanting to do more complex grouping discovered they could
do "SPARQL-injection" and use for example P131/wdt:P131 as input,
which would then be inserted as wdt:P131/wdt:P131.

We wanted to support non-property Wikibase predicates,
such as dct:language, Lexemes being the main use-case.

So in f2ffd22d (and 801ddeb68), we made it so that anything
matching P\d+ would be considered a property, with the legacy
behaviour of adding the wdt: prefix ; and anything else would
be considered a predicate, added as is in the SPARQL query.

This overlooked the SPARQL-injection use-case: P131/wdt:P131
would be matching the P\d+ regular expression, but would fail
the Pywikibot lookup that happens just after.

Here we only create PropertyGroupingConfiguration object for a stricter ^P\d+$ match ;
and we restore backwards compatibility with "SPARQL-injection" by matching ^P\d+
with a PredicateGroupingConfiguration, with the added wdt: prefix.

Also add a unit-test checking the behaviour.

[1] Stack trace:

File "./grouping.py", line 27, in make property_page = pywikibot.PropertyPage(repo, grouping_property)
...
pywikibot.exceptions.InvalidTitleError: 'P131/wdt:P131' is not a valid property page title

Details

Provenance
JeanFredAuthored on Tue, Apr 30, 6:52 PM
Parents
R2566:c9b19948d2d3: Extract wikibase:label service clause from `get_filter_for_nega|tive_query`
Branches
Unknown
Tags
Unknown
ChangeId
None