Page MenuHomePhabricator
Create Task
Maniphest T247428

Improve caused-by lines as seen for GlobalBlocking
Closed, ResolvedPublic
Actions

Description

From T247365:

<file name="includes/GlobalBlockingHooks.php">
    <error line="187" severity="warning" message="Calling method \OutputPage::addHTML() in \GlobalBlockingHooks::onSpecialContributionsBeforeMainOutput that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: Builtin-\Html::rawElement; Builtin-\Html::rawElement; ../../includes/Html.php +210; Builtin-\Html::rawElement; Builtin-\Html::rawElement; Builtin-\Message::parseAsBlock; Builtin-\Html::rawElement; Builtin-\Html::rawElement; ../../includes/Html.php +210; Builtin-\Html::rawElement; Builtin-\Html::rawElement; includes/GlobalBlockingHooks.php +184)" source="SecurityCheck-XSS"/>
  </file>

It's as long as useless.

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
Don't link parameters of functions with hardcoded taintednessmediawiki/tools/phan/SecurityCheckPluginmaster+134 -3
Improve caused-by linesmediawiki/tools/phan/SecurityCheckPluginmaster+69 -10
Customize query in gerrit

Related Objects

Event Timeline

Daimona created this task.Mar 11 2020, 5:43 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 11 2020, 5:43 PM
sbassett subscribed.Mar 11 2020, 7:22 PM
gerritbot added a comment.Apr 5 2020, 3:02 PM

Change 586098 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] [WIP] Long caused-by lines

https://gerrit.wikimedia.org/r/586098

gerritbot added a project: Patch-For-Review.Apr 5 2020, 3:02 PM
Daimona added a comment.Apr 25 2020, 5:11 PM

r592448 helps a bit by removing some rawElement repetitions, bringing it down from

integration/long-causedby/test.php:11 SecurityCheck-XSS Calling method \A::output() in \A::main that outputs using tainted argument $[arg #1]. (Caused by: integration/long-causedby/test.php +17) (Caused by: Builtin-\Html::rawElement; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11)

to

integration/long-causedby/test.php:11 SecurityCheck-XSS Calling method \A::output() in \A::main that outputs using tainted argument $[arg #1]. (Caused by: integration/long-causedby/test.php +17) (Caused by: Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11; Builtin-\Html::rawElement; integration/long-causedby/test.php +11)
Daimona moved this task from Backlog to Plugin itself on the phan-taint-check-plugin board.Jul 9 2020, 4:00 PM
Daimona claimed this task.Jan 7 2021, 1:31 PM
Aklapper mentioned this in T272123: Merging to MediaWiki/extensions/CentralAuth is blocked.Jan 15 2021, 8:38 AM
gerritbot added a comment.Jan 15 2021, 11:00 PM

Change 656455 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Don't link parameters of functions with hardcoded taintedness

https://gerrit.wikimedia.org/r/656455

gerritbot added a comment.Jan 21 2021, 5:24 AM

Change 586098 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Improve caused-by lines

https://gerrit.wikimedia.org/r/586098

gerritbot added a comment.Jan 21 2021, 5:25 AM

Change 656455 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Don't link parameters of functions with hardcoded taintedness

https://gerrit.wikimedia.org/r/656455

Jdforrester-WMF mentioned this in rMTPS8120d02b2e1a: Improve caused-by lines.Jan 21 2021, 5:50 AM
Jdforrester-WMF mentioned this in rMTPSb2ddd1ae03da: Don't link parameters of functions with hardcoded taintedness.
Maintenance_bot removed a project: Patch-For-Review.Jan 21 2021, 6:10 AM
Daimona closed this task as Resolved.Jan 21 2021, 12:21 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits