Basically the same as T260633: BotPasswords doesn't validate length of resultant bp_grants JSON, but for numerous different fields
oarc_grants, oarc_oauth2_allowed_grants and oaac_grants don't validate the JSON going into them... So in a case where there's many many many grants, it's possible to end up with JSON longer than BLOB, which will be inserted and truncated
Technically blocks T108255: Enable MariaDB/MySQL's Strict Mode
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | Security | None | T260636 OAuth doesn't validate length of grants fields | ||
| Resolved | Security | Reedy | T277379 OAuth doesn't validate length of oarc_grants and oarc_oauth2_allowed_grants JSON |
oaac_grants is probably less of an issue, as IIRC, there's no way to modify oarc_grants before it's copied over to oaac_grants when "approved"; so as long as we make sure it's valid when it's originally inserted, it should be valid when it's copied across
Resetting task status from "In Progress" to "Open" as this task has not seen updates for two years.
@Reedy: Removing task assignee as this open task has been assigned for more than two years - See the email sent on 2025-05-22.
Please assign this task to yourself again if you still realistically [plan to] work on this task - it would be welcome!
If this task has been resolved in the meantime, or should not be worked on by anybody ("declined"), please update its task status via "Add Action… 🡒 Change Status".
Also see https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup for tips how to best manage your individual work in Phabricator. Thanks!
I feel like this could probably be made public, especially given its age. It seems like a low-risk Vuln-DoS or SQL error at worst.
The SQL command will work and then we'll end up with a consumer that cannot be used or modified, like with {T260578}. Agreed it's low risk.
(Also does this actually happen? People do sometimes make requests with all checkboxes checked.)
Also, seems mostly fixed by T277379: OAuth doesn't validate length of oarc_grants and oarc_oauth2_allowed_grants JSON. I guess the same change would have to be done for oaac_grants as well?