Page MenuHomePhabricator
Create Task
Maniphest T201402

Fix phan-taint-check-plugin issues in FileImporter
Closed, ResolvedPublic2 Estimated Story Points
Actions

Description

phan-taint-check-plugin is a phan plugin meant to use static analysis to find certain types of security vulnerabilities in MediaWiki extensions.

See https://www.mediawiki.org/wiki/SecurityCheckPlugin

The current master if the FileImporter does not pass the checks.

Details

ProjectBranchLines +/-Subject
mediawiki/extensions/FileImportermaster+7 -11Remove obsolete empty <div>
mediawiki/extensions/FileImportermaster+20 -12Use phan-taint-check-plugin and fix issues
integration/configmaster+1 -0Enable phan-taint-check-plugin for FileImporter
Customize query in gerrit

Related Objects

Event Timeline

WMDE-Fisch created this task.Aug 7 2018, 11:18 AM
Restricted Application added a project: archived--TCB-Team. · View Herald TranscriptAug 7 2018, 11:18 AM
WMDE-Fisch claimed this task.Aug 7 2018, 11:19 AM
WMDE-Fisch set the point value for this task to 2.
WMDE-Fisch moved this task from Sprint Backlog to Review on the WMDE-QWERTY-Sprint-2018-07-31 board.
gerritbot added a subscriber: gerritbot.Aug 7 2018, 11:20 AM

Change 450942 had a related patch set uploaded (by WMDE-Fisch; owner: WMDE-Fisch):
[mediawiki/extensions/FileImporter@master] Use phan-taint-check-plugin and fix issues

https://gerrit.wikimedia.org/r/450942

gerritbot added a project: Patch-For-Review.Aug 7 2018, 11:20 AM
WMDE-Fisch moved this task from Backlog to Wikimedia deployed on the phan-taint-check-plugin board.Aug 7 2018, 11:20 AM
WMDE-Fisch mentioned this in rEFLIf5229141ca67: Use phan-taint-check-plugin and fix issues.Aug 7 2018, 11:23 AM
gerritbot added a comment.Aug 8 2018, 8:44 AM

Change 451247 had a related patch set uploaded (by WMDE-Fisch; owner: WMDE-Fisch):
[integration/config@master] Enable phan-taint-check-plugin for FileImporter

https://gerrit.wikimedia.org/r/451247

WMDE-Fisch mentioned this in rEFLI725f44f3dd64: Use phan-taint-check-plugin and fix issues.Aug 8 2018, 9:01 AM
gerritbot added a comment.Aug 13 2018, 2:18 PM

Change 452375 had a related patch set uploaded (by Thiemo Kreuz (WMDE); owner: Thiemo Kreuz (WMDE)):
[mediawiki/extensions/FileImporter@master] Remove obsolete empty <div>

https://gerrit.wikimedia.org/r/452375

thiemowmde mentioned this in rEFLId396e418c180: Remove obsolete empty <div>.Aug 13 2018, 2:18 PM
gerritbot added a comment.Aug 13 2018, 2:26 PM

Change 450942 merged by jenkins-bot:
[mediawiki/extensions/FileImporter@master] Use phan-taint-check-plugin and fix issues

https://gerrit.wikimedia.org/r/450942

ReleaseTaggerBot added a project: MW-1.32-notes (WMF-deploy-2018-08-14 (1.32.0-wmf.17)).Aug 13 2018, 3:00 PM
gerritbot added a comment.Aug 13 2018, 4:01 PM

Change 451247 merged by jenkins-bot:
[integration/config@master] Enable phan-taint-check-plugin for FileImporter

https://gerrit.wikimedia.org/r/451247

Addshore added a subscriber: Addshore.Aug 13 2018, 4:05 PM

Looks like this passes now and I just deployed the patch to enable the job in CI

WMDE-Fisch moved this task from Review to Done on the WMDE-QWERTY-Sprint-2018-07-31 board.Aug 14 2018, 7:13 AM
In T201402#4498986, @Addshore wrote:

Looks like this passes now and I just deployed the patch to enable the job in CI

Thanks Adam!

WMDE-Fisch moved this task from Backlog to Tickets in sprint on the Move-Files-To-Commons board.Aug 14 2018, 7:13 AM
WMDE-Fisch closed this task as Resolved.Aug 14 2018, 12:57 PM
thiemowmde mentioned this in rEFLI04758cf5b36b: Remove obsolete empty <div>.Aug 14 2018, 3:26 PM
Jdforrester-WMF edited projects, added MW-1.32-notes (WMF-deploy-2018-08-21 (1.32.0-wmf.18)); removed MW-1.32-notes (WMF-deploy-2018-08-14 (1.32.0-wmf.17)).Aug 14 2018, 8:54 PM
gerritbot added a comment.Aug 15 2018, 6:47 AM

Change 452375 merged by jenkins-bot:
[mediawiki/extensions/FileImporter@master] Remove obsolete empty <div>

https://gerrit.wikimedia.org/r/452375

sbassett moved this task from Wikimedia deployed to Done on the phan-taint-check-plugin board.Oct 15 2019, 6:52 PM
Maintenance_bot removed a project: Patch-For-Review.Oct 15 2019, 7:17 PM
sbassett triaged this task as Medium priority.Oct 15 2019, 7:42 PM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL