Use composer/semver to validate oauth registration versions
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Mar 13 2021, 6:05 PM

Description

src/Control/ConsumerSubmitControl.php has

'version'      => '/^\d{1,3}(\.\d{1,2}){0,2}(-(dev|alpha|beta))?$/',

Seems better if we can just use composer/semver to validate rather than wheel reinvention?

Details

Subject	Repo	Branch	Lines +/-
Better validation of oauth_registered_consumer.oarc_version	mediawiki/extensions/OAuth	REL1_31	+13 -1
Better validation of oauth_registered_consumer.oarc_version	mediawiki/extensions/OAuth	REL1_35	+14 -1
Better validation of oauth_registered_consumer.oarc_version	mediawiki/extensions/OAuth	master	+14 -1

Customize query in gerrit

Related Objects

Mentioned In: T277399: Allow more specific error messages in SubmitControl::validateFields()
T277388: OAuth doesn't validate length of oarc_version (CVE-2021-31555)
Mentioned Here: T277388: OAuth doesn't validate length of oarc_version (CVE-2021-31555)

Event Timeline

Reedy created this task.Mar 13 2021, 6:05 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 13 2021, 6:06 PM

Reedy mentioned this in T277388: OAuth doesn't validate length of oarc_version (CVE-2021-31555).Mar 13 2021, 6:06 PM

Reedy updated the task description. (Show Details)

Reedy added a subscriber: Legoktm.Mar 13 2021, 9:24 PM

Change 671707 had a related patch set uploaded (by Reedy; owner: Reedy):
[mediawiki/extensions/OAuth@master] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/671707

gerritbot added a project: Patch-For-Review.Mar 13 2021, 11:19 PM

Reedy mentioned this in T277399: Allow more specific error messages in SubmitControl::validateFields().Mar 14 2021, 12:51 AM

Change 671707 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/671707

Maintenance_bot removed a project: Patch-For-Review.Mar 15 2021, 7:10 AM

Legoktm closed this task as Resolved.Mar 15 2021, 7:51 AM

Legoktm assigned this task to Reedy.

Change 676364 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_35] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/676364

Change 676365 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_31] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/676365

Change 676364 merged by jenkins-bot: