Page MenuHomePhabricator
Create Task
Maniphest T207088

Remex double-decodes HTML entities on PHP (not HHVM)
Closed, ResolvedPublic
Actions

Description

For example, given

`[[File:Foobar.jpg|alt=&]]`

PHP will render this in HTML as alt="&" while HHVM correctly renders alt="&".

This is a bug in the tokenizer, where we take a shortcut in Tokenizer::handleCharRefs() and then turn around and decode the entities again "the long way", leading to a double-decode.

Details

ProjectBranchLines +/-Subject
mediawiki/coreREL1_31+1 -1Upgrade wikimedia/remex-html to 2.0.1
mediawiki/vendorREL1_31+20 -29Upgrade wikimedia/remex-html to 2.0.1
mediawiki/coreREL1_32+1 -1Upgrade wikimedia/remex-html to 2.0.1
mediawiki/vendorREL1_32+20 -29Upgrade wikimedia/remex-html to 2.0.1
mediawiki/coremaster+1 -1Upgrade wikimedia/remex-html to 2.0.1
mediawiki/vendormaster+20 -29Upgrade wikimedia/remex-html to 2.0.1
mediawiki/libs/RemexHtmlmaster+18 -9Don't double-decode HTML entities on non-HHVM PHP
Customize query in gerrit

Related Objects

Event Timeline

cscott created this task.Oct 15 2018, 8:15 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 15 2018, 8:15 PM
gerritbot added a subscriber: gerritbot.Oct 15 2018, 8:15 PM

Change 467470 had a related patch set uploaded (by C. Scott Ananian; owner: C. Scott Ananian):
[mediawiki/libs/RemexHtml@master] Don't double-decode HTML entities on non-HHVM PHP

https://gerrit.wikimedia.org/r/467470

gerritbot added a project: Patch-For-Review.Oct 15 2018, 8:15 PM
cscott added a subscriber: tstarling.Oct 15 2018, 8:32 PM
cscott mentioned this in T206940: Quote marks in "alt" text break media attribute parsing.Oct 16 2018, 1:33 PM
Krinkle added projects: PHP 7.0 support, PHP 7.3 support.Oct 16 2018, 4:55 PM
gerritbot added a comment.Oct 17 2018, 1:30 AM

Change 467470 merged by jenkins-bot:
[mediawiki/libs/RemexHtml@master] Don't double-decode HTML entities on non-HHVM PHP

https://gerrit.wikimedia.org/r/467470

cscott added a comment.Oct 17 2018, 2:12 AM

The patch is merged, but we're going to need a new version of remex released to composer and mediawiki-core updated to require the new version before this bug is actually fixed in production uses of php 7 (ie, when running the php 7 jenkins tests).

cscott mentioned this in T207483: Release remex 2.0.1.Oct 19 2018, 3:48 PM
Legoktm added projects: MW-1.31-release, MW-1.32-notes.Oct 21 2018, 5:11 AM
Legoktm edited projects, added MW-1.32-release; removed MW-1.32-notes.
gerritbot added a comment.Oct 21 2018, 5:12 AM

Change 468799 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/vendor@master] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468799

gerritbot added a comment.Oct 21 2018, 5:12 AM

Change 468800 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/core@master] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468800

gerritbot added a comment.Oct 21 2018, 5:38 PM

Change 468799 merged by jenkins-bot:
[mediawiki/vendor@master] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468799

gerritbot added a comment.Oct 21 2018, 5:59 PM

Change 468800 merged by jenkins-bot:
[mediawiki/core@master] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468800

ReleaseTaggerBot added a project: MW-1.33-notes (1.33.0-wmf.1; 2018-10-23).Oct 21 2018, 6:00 PM
gerritbot added a comment.Oct 21 2018, 6:13 PM

Change 468852 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/vendor@REL1_32] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468852

gerritbot added a comment.Oct 21 2018, 6:13 PM

Change 468853 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/core@REL1_32] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468853

gerritbot added a comment.Oct 21 2018, 6:30 PM

Change 468852 merged by jenkins-bot:
[mediawiki/vendor@REL1_32] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468852

gerritbot added a comment.Oct 21 2018, 6:40 PM

Change 468853 merged by jenkins-bot:
[mediawiki/core@REL1_32] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468853

ReleaseTaggerBot added a project: MW-1.32-notes.Oct 21 2018, 7:00 PM
gerritbot added a comment.Oct 21 2018, 7:05 PM

Change 468862 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/core@REL1_31] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468862

gerritbot added a comment.Oct 21 2018, 7:20 PM

Change 468864 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/vendor@REL1_31] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468864

Legoktm closed this task as Resolved.Oct 21 2018, 7:33 PM
Legoktm claimed this task.
Legoktm added a subscriber: Legoktm.

I've backported to 1.32, and prepped 1.31 backports.

gerritbot added a comment.Oct 22 2018, 3:18 PM

Change 468864 merged by jenkins-bot:
[mediawiki/vendor@REL1_31] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468864

gerritbot added a comment.Oct 22 2018, 3:18 PM

Change 468862 merged by jenkins-bot:
[mediawiki/core@REL1_31] Upgrade wikimedia/remex-html to 2.0.1

https://gerrit.wikimedia.org/r/468862

ReleaseTaggerBot added a project: MW-1.31-release-notes.Oct 22 2018, 4:01 PM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL