See https://integration.wikimedia.org/ci/job/mwext-php72-phan-docker/91675/console
includes/specials/SpecialMultiLock.php:344 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \SpecialMultiLock::showUserTable that outputs using tainted argument #1 ($rowtext). (Caused by: Builtin-\OutputPage::addHTML)
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Fix phan errors? | mediawiki/extensions/CentralAuth | master | +8 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Iniquity | T272019 Add missing Russian alias for Special:GlobalRenameRequest | |||
| Resolved | DannyS712 | T272123 Merging to MediaWiki/extensions/CentralAuth is blocked |
Output mentions userList and showUserTable; showUserTable is only in /includes/specials/SpecialMultiLock.php and the last change touching that file was the one-liner in rECAUe088712c76686107caa2af201ce596fbe960e9e4 . No idea if related but giving a heads-up to @DannyS712.
(Also, T247428: Improve caused-by lines as seen for GlobalBlocking comes to my mind.)
Wasn't me, wasn't related, but thanks for the heads up
@Daimona might know more - was there a core change that could have triggered this? I don't see anything recent
I managed to get the failure on a blank patch too https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/656297 so I'm not insane and it is 100% master already.
Change 656298 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[mediawiki/extensions/CentralAuth@master] Fix phan errors?
Change 656298 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Fix phan errors?
Yeah, unrelated changes can cause new errors, this is fairly common in static analysis. Taint-check is specifically vulnerable to this because the result depends on the order in which source files are analyzed (due to how method dependencies are tracked). I'm investigating the errors and will report in the follow-up task.