Page MenuHomePhabricator

Allow using relative paths in array config vars
Closed, ResolvedPublic

Description

extension.json config allows parsing relative paths via "path": true,.
Unfortunately, that functionality is limited to string values only - an array of strings (even when using "path": true,, won't get their paths transformed)

I think it's fair to expect that arrays of relative paths are also converted when using "path": true, in the config.
An existing use case it Wikibase's $wgWikibasePerRepositoryServiceWiringFiles, which is an array of paths.
Unless we're able to use an array of relative paths here in extension.json, we'd otherwise have to resort do doing it from PHP.

Details

Related Gerrit Patches:

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 525784 had a related patch set uploaded (by Matthias Mullie; owner: Matthias Mullie):
[mediawiki/core@master] Allow using relative paths in array config vars

https://gerrit.wikimedia.org/r/525784

Reedy added a subscriber: Reedy.

While I'm happy for allowing an array of paths (that makes perfect sense), the relative-ness does give cause for concern

What's to stop a malicious extension reading arbitrary files from disk, and then doing whatever with them?

Change 525784 merged by jenkins-bot:
[mediawiki/core@master] Registration: Allow relative paths in config arrays, not just strings

https://gerrit.wikimedia.org/r/525784

While I'm happy for allowing an array of paths (that makes perfect sense), the relative-ness does give cause for concern
What's to stop a malicious extension reading arbitrary files from disk, and then doing whatever with them?

Existing functionality. File a new task?

Reedy closed this task as Resolved.Oct 8 2019, 7:03 PM
Reedy assigned this task to matthiasmullie.