Maniphest T195010

CategoryTree extension does not pass phan-taint-check 1.2.0
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Umherirrender
	May 18 2018, 8:04 PM

Description

CategoryTree also has some potentially false positives from the new version:

./includes/CategoryTreeHooks.php:113 SecurityCheck-XSS Outputting user controlled HTML from Parser function hook \CategoryTreeHooks::parserFunction (Caused by: ./includes/CategoryTreeHooks.php +112)
./includes/CategoryTreeHooks.php:168 SecurityCheck-XSS Outputting user controlled HTML from Parser tag hook \CategoryTreeHooks::parserHook (Caused by: ./includes/CategoryTree.php +386; ./includes/CategoryTreeHooks.php +144; ./includes/CategoryTreeHooks.php +155)
./includes/CategoryTreePage.php:119 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \CategoryTreePage::execute that outputs using tainted argument $[arg #1]. (Caused by: ./includes/CategoryTree.php +556)

Details

Project	Branch	Lines +/-	Subject
mediawiki/extensions/CategoryTree	REL1_31	+13 -10	Fix some raw html messages
mediawiki/extensions/CategoryTree	master	+13 -10	Fix some raw html messages
mediawiki/tools/phan/SecurityCheckPlugin	master	+44 -0	Add code to force type for MW globals

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		None	T193909 update phan-taint-check to 1.2.0
		Resolved		Legoktm	T195010 CategoryTree extension does not pass phan-taint-check 1.2.0

Event Timeline

Umherirrender triaged this task as Medium priority.May 18 2018, 8:04 PM

Umherirrender created this task.

Umherirrender mentioned this in T193909: update phan-taint-check to 1.2.0.

Umherirrender mentioned this in T182599: Make jenkins run phan-taint-check-plugin non-voting and then voting.May 18 2018, 8:12 PM

• Vvjjkkii renamed this task from CategoryTree extension does not pass phan-taint-check 1.2.0 to dqcaaaaaaa.Jul 1 2018, 1:09 AM

• Vvjjkkii raised the priority of this task from Medium to High.

• Vvjjkkii added projects: CheckUser, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), Tamil-Sites, Gamepress, Hashtags, Jade, KartoEditor, Language-2018-Apr-June, New-Editor-Experiences, Mail, TCB-Team (now WMDE-TechWish).

• Vvjjkkii updated the task description. (Show Details)

• Vvjjkkii removed a subscriber: Aklapper.

CommunityTechBot renamed this task from dqcaaaaaaa to CategoryTree extension does not pass phan-taint-check 1.2.0.Jul 2 2018, 4:53 AM

CommunityTechBot lowered the priority of this task from High to Medium.

CommunityTechBot updated the task description. (Show Details)

CommunityTechBot removed projects: TCB-Team (now WMDE-TechWish), Mail, New-Editor-Experiences, Language-2018-Apr-June, KartoEditor, Jade, Hashtags, Gamepress, Tamil-Sites, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), CheckUser.

CommunityTechBot added a subscriber: Aklapper.

Change 444017 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Add code to force type for MW globals

https://gerrit.wikimedia.org/r/444017

gerritbot added a project: Patch-For-Review.Jul 5 2018, 4:34 PM

Change 444019 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/extensions/CategoryTree@master] Fix some raw html messages

https://gerrit.wikimedia.org/r/444019

In T195010#4400503, @gerritbot wrote:

Change 444019 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/extensions/CategoryTree@master] Fix some raw html messages

https://gerrit.wikimedia.org/r/444019

This patch + the phan patch make CategoryTree pass

Change 444017 merged by Brian Wolff:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Add code to force type for MW globals

https://gerrit.wikimedia.org/r/444017

Change 444019 merged by jenkins-bot:
[mediawiki/extensions/CategoryTree@master] Fix some raw html messages

https://gerrit.wikimedia.org/r/444019

ReleaseTaggerBot added a project: MW-1.32-notes (WMF-deploy-2018-08-07 (1.32.0-wmf.16)).Aug 2 2018, 9:00 AM

Legoktm moved this task from Backlog to Wikimedia deployed on the phan-taint-check-plugin board.Aug 2 2018, 9:39 AM

Now using 1.3.0 since https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/CategoryTree/+/453890/

Change 490510 had a related patch set uploaded (by Krinkle; owner: Brian Wolff):
[mediawiki/extensions/CategoryTree@REL1_31] Fix some raw html messages

https://gerrit.wikimedia.org/r/490510

Change 490510 merged by jenkins-bot:
[mediawiki/extensions/CategoryTree@REL1_31] Fix some raw html messages

https://gerrit.wikimedia.org/r/490510

sbassett moved this task from Wikimedia deployed to Done on the phan-taint-check-plugin board.Oct 15 2019, 6:55 PM

Maintenance_bot removed a project: Patch-For-Review.Oct 15 2019, 7:20 PM