Page MenuHomePhabricator
Create Task
Maniphest T202382

Make phan-taint-check-plugin voting for CirrusSearch extension
Closed, ResolvedPublic
Actions

Description

Would be nice to make phan-taint-check-plugin voting for CirrusSearch extensions

<?xml version="1.0" encoding="ISO-8859-15"?>
<checkstyle version="6.5">
  <file name="./tests/phpunit/Maintenance/ScriptsRunnablePreload.php">
    <error line="16" severity="warning" message="Calling method \wfCirrusUnitTestScriptsRunablePreload() in [no method] that outputs using tainted argument $[arg #1]. (Caused by: ./tests/phpunit/Maintenance/ScriptsRunnablePreload.php +12)" source="SecurityCheck-OTHER"/>
  </file>
</checkstyle>

Details

SubjectRepoBranchLines +/-
seccheck for CheckUser and CirrusSearchintegration/configmaster+2 -1
Customize query in gerrit

Related Objects
Search...

Event Timeline

Umherirrender created this task.Aug 21 2018, 12:18 PM
Restricted Application added a project: Discovery-Search. · View Herald TranscriptAug 21 2018, 12:18 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Umherirrender renamed this task from Add phan-taint-check-plugin to CirrusSearch extension to Make phan-taint-check-plugin voting for CirrusSearch extension.Aug 21 2018, 12:18 PM
Umherirrender updated the task description. (Show Details)
Umherirrender moved this task from Backlog to Wikimedia deployed on the phan-taint-check-plugin board.
Umherirrender added a parent task: T201219: Enable phan-taint-check-plugin on all Wikimedia-deployed repositories after getting it to pass.Aug 21 2018, 12:40 PM
EBernhardson subscribed.Aug 23 2018, 5:06 PM

The error is only reported in the test class, but i don't think taint analysis is of any use for code only run the test suite. The file is documented as entirely a hack that allows testing of certain hard to test parts of maintenance scripts.

Legoktm subscribed.Aug 23 2018, 5:59 PM

Will pass once https://gerrit.wikimedia.org/r/c/mediawiki/tools/phan/SecurityCheckPlugin/+/454634 is released.

gerritbot subscribed.Aug 30 2018, 6:59 AM

Change 456337 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[integration/config@master] seccheck for CheckUser and CirrusSearch

https://gerrit.wikimedia.org/r/456337

gerritbot added a project: Patch-For-Review.Aug 30 2018, 6:59 AM
gerritbot added a comment.Aug 30 2018, 7:01 AM

Change 456337 merged by jenkins-bot:
[integration/config@master] seccheck for CheckUser and CirrusSearch

https://gerrit.wikimedia.org/r/456337

Legoktm closed this task as Resolved.Aug 30 2018, 7:14 AM
Legoktm claimed this task.
sbassett moved this task from Wikimedia deployed to Done on the phan-taint-check-plugin board.Oct 15 2019, 6:53 PM
Maintenance_bot removed a project: Patch-For-Review.Oct 15 2019, 7:13 PM
sbassett triaged this task as Medium priority.Oct 15 2019, 7:35 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL