Page MenuHomePhabricator

AbuseFilter should not allow adding a tag which is applied manually
Open, Needs TriagePublic

Description

At the moment, it is allowed (seen on Wikidata) but it makes the system unstable. When the filter is saved, the tag can be added by both filters and users but cannot be removed.

Event Timeline

This should be addressed as part of a much needed overhaul of tag validation, specifically T173917 and T154749

Change 700850 had a related patch set uploaded (by Matěj Suchánek; author: Matěj Suchánek):

[mediawiki/extensions/AbuseFilter@master] Clarify ChangeTagValidator::validateTag and disallow user-defined tags

https://gerrit.wikimedia.org/r/700850

Occurrences across wikis: P56851 (111 filters on 40 wikis)
Query:

SELECT afa_filter, ctd_name
FROM change_tag_def, abuse_filter_action
WHERE ctd_user_defined = 1
AND afa_consequence = 'tag' AND (
  afa_parameters = ctd_name
  OR afa_parameters LIKE CONCAT('%\n', ctd_name)
  OR afa_parameters LIKE CONCAT(ctd_name, '\n%')
  OR afa_parameters LIKE CONCAT('%\n', ctd_name, '\n%')
);