Page MenuHomePhabricator
Create Task
Maniphest T274955

PHP Notice: Array to string conversion in oojs-ui/php/widgets/InputWidget (via SpecialContributions.php)
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

Error message
ErrorException: PHP Notice: Array to string conversion
Stack Trace
from /srv/mediawiki/php-1.36.0-wmf.30/vendor/oojs/oojs-ui/php/widgets/InputWidget.php(130)
#0 /srv/mediawiki/php-1.36.0-wmf.30/vendor/oojs/oojs-ui/php/widgets/InputWidget.php(130): MWExceptionHandler::handleError(integer, string, string, integer, array)
#1 /srv/mediawiki/php-1.36.0-wmf.30/vendor/oojs/oojs-ui/php/widgets/CheckboxMultiselectInputWidget.php(92): OOUI\InputWidget->cleanUpValue(array)
#2 /srv/mediawiki/php-1.36.0-wmf.30/vendor/oojs/oojs-ui/php/widgets/CheckboxMultiselectInputWidget.php(67): OOUI\CheckboxMultiselectInputWidget->cleanUpValue(array)
#3 /srv/mediawiki/php-1.36.0-wmf.30/vendor/oojs/oojs-ui/php/widgets/CheckboxMultiselectInputWidget.php(50): OOUI\CheckboxMultiselectInputWidget->setValue(array)
#4 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/fields/HTMLMultiSelectField.php(218): OOUI\CheckboxMultiselectInputWidget->__construct(array)
#5 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/HTMLFormField.php(604): HTMLMultiSelectField->getInputOOUI(array)
#6 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/HTMLForm.php(1730): HTMLFormField->getOOUI(array)
#7 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/HTMLForm.php(1750): HTMLForm->displaySection(array, string, string, boolean)
#8 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/HTMLForm.php(1322): HTMLForm->displaySection(array, string)
#9 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/OOUIHTMLForm.php(290): HTMLForm->getBody()
#10 /srv/mediawiki/php-1.36.0-wmf.30/includes/htmlform/HTMLForm.php(1103): OOUIHTMLForm->getBody()
#11 /srv/mediawiki/php-1.36.0-wmf.30/includes/specials/SpecialContributions.php(805): HTMLForm->getHTML(boolean)
#12 /srv/mediawiki/php-1.36.0-wmf.30/includes/specials/SpecialContributions.php(297): SpecialContributions->getForm(array)
#13 /srv/mediawiki/php-1.36.0-wmf.30/includes/specialpage/SpecialPage.php(645): SpecialContributions->execute(NULL)
#14 /srv/mediawiki/php-1.36.0-wmf.30/includes/specialpage/SpecialPageFactory.php(1405): SpecialPage->run(NULL)
#15 /srv/mediawiki/php-1.36.0-wmf.30/includes/MediaWiki.php(310): MediaWiki\SpecialPage\SpecialPageFactory->executePath(Title, RequestContext)
#16 /srv/mediawiki/php-1.36.0-wmf.30/includes/MediaWiki.php(944): MediaWiki->performRequest()
#17 /srv/mediawiki/php-1.36.0-wmf.30/includes/MediaWiki.php(548): MediaWiki->main()
#18 /srv/mediawiki/php-1.36.0-wmf.30/index.php(53): MediaWiki->run()
#19 /srv/mediawiki/php-1.36.0-wmf.30/index.php(46): wfIndexMain()
#20 /srv/mediawiki/w/index.php(3): require(string)
#21 {main}
Impact

logspam

Notes

Details

Request ID
YCxK2fWmIPEWIxGoA3xMOQAAABU
Request URL
https://commons.wikimedia.org/wiki/Special:Contributions?end=2019-03-25&hideMinor=1&limit=50&namespace=all&newOnly=1&start=2019-03-25&tagfilter=17&target=Majora&title=Special:Contributions&&wpfilters[][%24acunetix]=1
SubjectRepoBranchLines +/-
HTMLMultiSelectField: Reject nested arrays earlymediawiki/coremaster+6 -0
SpecialContributions: Remove unneeded codemediawiki/coremaster+0 -3
Customize query in gerrit

Related Objects

Event Timeline

• mmodell created this task.Feb 16 2021, 10:56 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 16 2021, 10:56 PM
Jdlrobson added a project: MediaWiki-Special-pages.Feb 16 2021, 11:05 PM
Jdlrobson added subscribers: Ammarpad, Umherirrender, Tgr.

The only recent changes to Special:contributions are 685bf6df042 and 91a8e6e2056 cc @Ammarpad @Umherirrender @Tgr in case these changes might have surfaced the issue.

I see no recent changes in the OOUI library but that is where the error originates from, so this is either a case of garbage in, garbage out from the Contributions special page, OR bad handling on the OOUI side.

matmarex subscribed.Feb 17 2021, 12:36 AM

The warning occurs because the 'wpfilters' URL query parameter is a two-dimensional array. The code in SpecialContributions::getForm() expects a normal array, and passes it to HTMLForm and so on until it crashes in CheckboxMultiselectInputWidget. The SpecialContributions code should validate it (or maybe it shouldn't even be accessing it? shouldn't that happen in HTMLForm somewhere?).

Also, the "acunetix" mentioned in the URL is an "end-to-end web security scanner", according to their website. Looks like someone is running it on us, and they just found a bug.

matmarex added a comment.Feb 17 2021, 12:37 AM

The bug was probably introduced in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/281100 in 2019.

Jdlrobson awarded a token.Feb 17 2021, 1:34 AM
Krinkle renamed this task from PHP Notice: Array to string conversion in oojs-ui/php/widgets/InputWidget.php:130 to PHP Notice: Array to string conversion in oojs-ui/php/widgets/InputWidget (via SpecialContributions.php).Feb 17 2021, 7:52 PM
Krinkle moved this task from Untriaged to Older on the Wikimedia-production-error board.
gerritbot added a comment.Feb 18 2021, 11:27 PM

Change 665223 had a related patch set uploaded (by Bartosz Dziewoński; owner: Bartosz Dziewoński):
[mediawiki/core@master] SpecialContributions: Remove unneeded code

https://gerrit.wikimedia.org/r/665223

gerritbot added a project: Patch-For-Review.Feb 18 2021, 11:27 PM

Change 665224 had a related patch set uploaded (by Bartosz Dziewoński; owner: Bartosz Dziewoński):
[mediawiki/core@master] HTMLMultiSelectField: Reject nested arrays early

https://gerrit.wikimedia.org/r/665224

matmarex added a comment.Feb 18 2021, 11:30 PM

Turns out that code in HTMLForm also did not handle this correctly.

matmarex claimed this task.Feb 18 2021, 11:30 PM
gerritbot added a comment.Feb 19 2021, 12:17 AM

Change 665223 merged by jenkins-bot:
[mediawiki/core@master] SpecialContributions: Remove unneeded code

https://gerrit.wikimedia.org/r/665223

gerritbot added a comment.Feb 19 2021, 12:21 AM

Change 665224 merged by jenkins-bot:
[mediawiki/core@master] HTMLMultiSelectField: Reject nested arrays early

https://gerrit.wikimedia.org/r/665224

ReleaseTaggerBot added a project: MW-1.36-notes (1.36.0-wmf.32; 2021-02-23).Feb 19 2021, 1:00 AM
Maintenance_bot removed a project: Patch-For-Review.Feb 19 2021, 1:10 AM
Jdforrester-WMF edited projects, added MediaWiki-HTMLForm; removed OOUI.Feb 19 2021, 4:12 AM
matmarex added a comment.Feb 19 2021, 7:11 PM

On second though, I wonder if this should be handled in WebRequest::getArray().

Allowing multi-dimensional arrays in query parameters in PHP is a big foot-gun, with plenty of potential for log spam (I looked at a few pages with similar uses of multiselect, and immediately found issues of the same kind in Special:NewFiles and Special:ActiveUsers) or even security bugs (hopefully not in our code… but here's a good example: https://www.php.net/manual/en/mongodb.security.request_injection.php), and I've never seen any MediaWiki-related code actually using that feature.

matmarex closed this task as Resolved.Feb 19 2021, 7:32 PM
matmarex mentioned this in T275238: Disallow accessing multi-dimensional arrays through WebRequest::getArray().

I filed T275238 for that follow-up.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL