Page MenuHomePhabricator

[Bug] API modules allow creating Properties with an empty datatype
Closed, ResolvedPublic

Description

I tried to find an existing ticket for this but can not make any sense of the search results Phabricator gives me.

There are currently 5 API modules based on the abstract ModifyEntity class:

  • wbeditentity
  • wbsetlabel
  • wbsetdescription
  • wbsetaliases
  • wbsetsitelink

They all allow to use a new=property parameter to create a new entity of any type supported. But only wbeditentity checks if the user provided a datatype=… parameter with an actually supported data type. The other 4 modules allow to create properties with an empty datatype.

NOTE: No Properties with an empty data type currently exist on wikidata.org, but they could in theory be created using one of the API modules mentioned.

Event Timeline

thiemowmde moved this task from incoming to consider for next sprint on the Wikidata board.

As far as I can tell, there are no properties with invalid datatype in the query service (http://tinyurl.com/kvabzcp), but I don’t know what the exporter or the updater would do with such properties. Perhaps Quarry would be better suited for this?

Edit: Nothing found on Quarry either (https://quarry.wmflabs.org/query/18830).

According to wb_property_info, no such broken properties with an empty property type exist on wikidata:

MariaDB [wikidatawiki_p]> select * from wb_property_info where pi_type = "";
Empty set (0.00 sec)

Edit: oh, just saw the quarry link. Never mind :)

As to solving this issue: PropertyContent::isValid should at least check that the datatype is not empty. PropertyHandler::createEmptyEntity should probably fail.

EntitySavingHelper::isEntityCreationSupported needs to distinguish between entities that can be created without additional information, and entities that do need additional information. We already distinguish whether an explicit ID is needed (or allowed) for creation. This mechanism would need to be extended.

Note that we introduced the ability to create entities from all the edit modules on purpose, to support automatic materialization of "virtual" MediaInfo entities. If we remove that ability, the UI for MediaInfo will need quite a bit of work.

Change 355443 had a related patch set uploaded (by Daniel Kinzler; owner: Daniel Kinzler):
[mediawiki/extensions/Wikibase@master] Prevent creation of Properties without data type [WIP].

https://gerrit.wikimedia.org/r/355443

daniel renamed this task from [Bug] Special pages allow creating Properties with an empty datatype to [Bug] API modules allow creating Properties with an empty datatype.May 24 2017, 4:52 PM
daniel updated the task description. (Show Details)

Btw, I suspect that other API modules that use EntitySavingHelper are also affected, e.g. SetClaimValue, RemoveQualifiers, etc. Basically, all API modules that modify an entity.

Change 355443 merged by jenkins-bot:
[mediawiki/extensions/Wikibase@master] Prevent saving of Properties with an empty datatype.

https://gerrit.wikimedia.org/r/355443

daniel claimed this task.