The config was added in T203630, and as of July we had 187 warnings, reported at T216348#5332594. As I wrote there, I'd suggest to wait for seccheck 3.0 before moving on, and start with DoubleEscaped checks disabled, if there'll still be too many of them.
Description
Description
Details
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| build: Enable SecurityCheck-DoubleEscaped and suppress issues | mediawiki/core | master | +39 -2 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Umherirrender | T231311 Enable seccheck for MW core | |||
| Resolved | Daimona | T183174 UserGroupMembership::getLink() causes a significant portion of false positives for phan-taint-check-plugin | |||
| Resolved | None | T216348 Suppress or fix non-double escape phan-taint-check warnings for MW core | |||
| Resolved | Daimona | T268891 taint-check fails on array-plus and assumed int|float type | |||
| Resolved | Daimona | T268905 taint-check has trouble for taintedness of unknown array keys and reports possible false positives | |||
| Resolved | Umherirrender | T268920 taint-check 3.1.0 showing more issues from type SecurityCheck-OTHER |
Event Timeline
Comment Actions
FTR: I think the target version for this should be the next major version of taint-check. Lately, I've been focusing on core issues, so several false positives are now gone. I think a necessary (and perhaps also sufficient) condition is to have https://gerrit.wikimedia.org/r/#/c/mediawiki/tools/phan/SecurityCheckPlugin/+/605551/ included in the target version.
Comment Actions
Change 652553 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] build: Enable phan-taint-check-plugin and suppress issues
Comment Actions
Change 652574 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] build: Enable SecurityCheck-DoubleEscaped and suppress issues
Comment Actions
Change 652574 merged by jenkins-bot:
[mediawiki/core@master] build: Enable SecurityCheck-DoubleEscaped and suppress issues
Comment Actions
It's done now, I would close it. The sub task needs to be work on even if this is resolved or open