Page MenuHomePhabricator
Create Task
Maniphest T277388

OAuth doesn't validate length of oarc_version (CVE-2021-31555)
Closed, ResolvedPublic
Actions

Description

-- Version of the application
oarc_version varbinary(32) NOT NULL,

It's 32 chars, but we don't validate the length.

				'version'      => '/^\d{1,3}(\.\d{1,2}){0,2}(-(dev|alpha|beta))?$/',

Technically blocks T108255: Enable MariaDB/MySQL's Strict Mode. See also T277387: Use composer/semver to validate oauth registration versions.

Details

SubjectRepoBranchLines +/-
Better validation of oauth_registered_consumer.oarc_versionmediawiki/extensions/OAuthREL1_31+13 -1
Better validation of oauth_registered_consumer.oarc_versionmediawiki/extensions/OAuthREL1_35+14 -1
Better validation of oauth_registered_consumer.oarc_versionmediawiki/extensions/OAuthmaster+14 -1
Customize query in gerrit

Related Objects

Event Timeline

Reedy created this task.Mar 13 2021, 6:06 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 13 2021, 6:06 PM
Reedy updated the task description. (Show Details)Mar 13 2021, 6:07 PM
Reedy mentioned this in T277387: Use composer/semver to validate oauth registration versions.
Ladsgroup awarded a token.Mar 13 2021, 6:11 PM
Reedy triaged this task as Low priority.Mar 13 2021, 9:24 PM
gerritbot added a comment.Mar 13 2021, 11:19 PM

Change 671707 had a related patch set uploaded (by Reedy; owner: Reedy):
[mediawiki/extensions/OAuth@master] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/671707

gerritbot added a project: Patch-For-Review.Mar 13 2021, 11:19 PM
Reedy mentioned this in T277399: Allow more specific error messages in SubmitControl::validateFields().Mar 14 2021, 12:51 AM
gerritbot added a comment.Mar 15 2021, 6:52 AM

Change 671707 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/671707

ReleaseTaggerBot added a project: MW-1.36-notes (1.36.0-wmf.35; 2021-03-16).Mar 15 2021, 7:00 AM
Maintenance_bot removed a project: Patch-For-Review.Mar 15 2021, 7:10 AM
Legoktm closed this task as Resolved.Mar 15 2021, 7:51 AM
Legoktm assigned this task to Reedy.
gerritbot added a comment.Apr 2 2021, 2:06 AM

Change 676364 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_35] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/676364

gerritbot added a project: Patch-For-Review.Apr 2 2021, 2:06 AM

Change 676365 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_31] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/676365

gerritbot added a comment.Apr 2 2021, 2:14 AM

Change 676364 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_35] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/676364

gerritbot added a comment.Apr 2 2021, 9:58 PM

Change 676365 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_31] Better validation of oauth_registered_consumer.oarc_version

https://gerrit.wikimedia.org/r/676365

Maintenance_bot removed a project: Patch-For-Review.Apr 2 2021, 10:10 PM
Reedy mentioned this in T270466: Write and send supplementary release announcement for extensions and skins with security patches (1.31.13/1.35.2).Apr 12 2021, 11:40 PM
sbassett renamed this task from OAuth doesn't validate length of oarc_version to OAuth doesn't validate length of oarc_version (CVE-2021-31555).Apr 23 2021, 7:05 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits