Page MenuHomePhabricator
Create Task
Maniphest T291005

TypeError: Argument 1 passed to ProofreadPage\Pagination\FilePagination::getPageTitle() must be of the type integer, float given, called in /srv/mediawiki/php-1.37.0-wmf.21/extensions/ProofreadPage/includes/ProofreadPage.php on line 413
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

Error
normalized_message
[{reqId}] {exception_url}   TypeError: Argument 1 passed to ProofreadPage\Pagination\FilePagination::getPageTitle() must be of the type integer, float given, called in /srv/mediawiki/php-1.37.0-wmf.21/extensions/ProofreadPage/includes/ProofreadPage.php on
exception.trace
from /srv/mediawiki/php-1.37.0-wmf.21/extensions/ProofreadPage/includes/Pagination/FilePagination.php(97)
#0 /srv/mediawiki/php-1.37.0-wmf.21/extensions/ProofreadPage/includes/ProofreadPage.php(413): ProofreadPage\Pagination\FilePagination->getPageTitle(double)
#1 /srv/mediawiki/php-1.37.0-wmf.21/extensions/ProofreadPage/includes/ProofreadPage.php(508): ProofreadPage\ProofreadPage::addPageNsNavigation(Title, SkinVector, array)
#2 /srv/mediawiki/php-1.37.0-wmf.21/includes/HookContainer/HookContainer.php(338): ProofreadPage\ProofreadPage::onSkinTemplateNavigationUniversal(SkinVector, array)
#3 /srv/mediawiki/php-1.37.0-wmf.21/includes/HookContainer/HookContainer.php(137): MediaWiki\HookContainer\HookContainer->callLegacyHook(string, array, array, array)
#4 /srv/mediawiki/php-1.37.0-wmf.21/includes/HookContainer/HookRunner.php(3474): MediaWiki\HookContainer\HookContainer->run(string, array, array)
#5 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinTemplate.php(1204): MediaWiki\HookContainer\HookRunner->onSkinTemplateNavigation__Universal(SkinVector, array)
#6 /srv/mediawiki/php-1.37.0-wmf.21/skins/Vector/includes/SkinVector.php(295): SkinTemplate->runOnSkinTemplateNavigationHooks(SkinVector, array)
#7 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinTemplate.php(1531): SkinVector->runOnSkinTemplateNavigationHooks(SkinVector, array)
#8 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinTemplate.php(826): SkinTemplate->buildContentNavigationUrls()
#9 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinTemplate.php(294): SkinTemplate->getPortletsTemplateData()
#10 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinMustache.php(79): SkinTemplate->getTemplateData()
#11 /srv/mediawiki/php-1.37.0-wmf.21/skins/Vector/includes/SkinVector.php(306): SkinMustache->getTemplateData()
#12 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinMustache.php(56): SkinVector->getTemplateData()
#13 /srv/mediawiki/php-1.37.0-wmf.21/includes/skins/SkinTemplate.php(150): SkinMustache->generateHTML()
#14 /srv/mediawiki/php-1.37.0-wmf.21/includes/OutputPage.php(2644): SkinTemplate->outputPage()
#15 /srv/mediawiki/php-1.37.0-wmf.21/includes/MediaWiki.php(939): OutputPage->output(boolean)
#16 /srv/mediawiki/php-1.37.0-wmf.21/includes/MediaWiki.php(952): MediaWiki::{closure}()
#17 /srv/mediawiki/php-1.37.0-wmf.21/includes/MediaWiki.php(559): MediaWiki->main()
#18 /srv/mediawiki/php-1.37.0-wmf.21/index.php(53): MediaWiki->run()
#19 /srv/mediawiki/php-1.37.0-wmf.21/index.php(46): wfIndexMain()
#20 /srv/mediawiki/w/index.php(3): require(string)
#21 {main}
Impact
Notes

ProofreadPage\Pagination\FilePagination::getPageTitle() enforces $pageNumber to be an integer since e7b6e4cbe4ef4ba824a05a58e2d7fd4865fe2677 which got deployed with 1.37.0-wmf.20.

Other URLs:

https://te.wikisource.org/wiki/%E0%B0%AA%E0%B1%81%E0%B0%9F:Aandhrapatrika_sanvatsaraadi_sanchika_1910.pdf/93163117872033647965648d77ce03c89e612460ce5b0539c
https://te.wikisource.org/wiki/%E0%B0%AA%E0%B1%81%E0%B0%9F:Aandhrapatrika_sanvatsaraadi_sanchika_1910.pdf/21416311245203409306eb23500d1451a3a49e15ee28c43a8e

Looks like it is simply bad user input. I am guessing the code should catch the wrong page and display a user error.

Details

Request URL
https://te.wikisource.org/wiki/%E0%B0%AA%E0%B1%81%E0%B0%9F:Aandhrapatrika_sanvatsaraadi_sanchika_1910.pdf/16116311245283409348a1147cd1e69dc4ea5e09b4249c1c31
SubjectRepoBranchLines +/-
Harden page number calculation to not run into PHP_INT_MAXmediawiki/extensions/ProofreadPagemaster+52 -0
Harden page number calculation to not run into PHP_INT_MAXmediawiki/extensions/ProofreadPagemaster+12 -4
Customize query in gerrit

Related Objects

Event Timeline

hashar created this task.Sep 14 2021, 7:26 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 14 2021, 7:26 PM
Daimona subscribed.Sep 14 2021, 8:15 PM

I'm not sure how this can happen. The code is

$pageNumber = $pagination->getPageNumber( $title );
// ... code that doesn't touch $pageNumber
$nextTitle  = $pagination->getPageTitle( $pageNumber + 1 );

getPageTitle does enforce the argument to be integer, but getPageNumber also enforces its return value to be an integer since the same patch (e7b6e4cbe4ef4ba824a05a58e2d7fd4865fe2677)!

FilePagination
public function getPageNumber( Title $pageTitle ): int {

There's even an explicit int cast on the (only) return line:

if ( $number > 0 ) {
	// Valid page numbers are integer > 0.
	return (int)$number;
}
Daimona added a comment.Sep 14 2021, 8:17 PM

Oh actually, I just figured it out. Looking at the url, $pageNumber is (int)"16116311245283409348a1147cd1e69dc4ea5e09b4249c1c31". The int cast produces PHP_INT_MAX, and adding 1 results in an integer overflow.

thcipriani moved this task from Untriaged to Sep 2021 on the Wikimedia-production-error board.Sep 15 2021, 6:51 PM
gerritbot added a comment.Oct 1 2021, 6:11 PM

Change 725352 had a related patch set uploaded (by Thiemo Kreuz (WMDE); author: Thiemo Kreuz (WMDE)):

[mediawiki/extensions/ProofreadPage@master] Harden page number calculation to not run into PHP_INT_MAX

https://gerrit.wikimedia.org/r/725352

gerritbot added a project: Patch-For-Review.Oct 1 2021, 6:11 PM
gerritbot added a comment.Oct 2 2021, 9:17 PM

Change 725438 had a related patch set uploaded (by Inductiveload; author: Thiemo Kreuz (WMDE)):

[mediawiki/extensions/ProofreadPage@master] Harden page number calculation to not run into PHP_INT_MAX

https://gerrit.wikimedia.org/r/725438

gerritbot added a comment.Oct 3 2021, 1:06 PM

Change 725352 merged by jenkins-bot:

[mediawiki/extensions/ProofreadPage@master] Harden page number calculation to not run into PHP_INT_MAX

https://gerrit.wikimedia.org/r/725352

ReleaseTaggerBot added a project: MW-1.38-notes (1.38.0-wmf.3; 2021-10-05).Oct 3 2021, 2:00 PM
gerritbot added a comment.Oct 3 2021, 4:17 PM

Change 725438 merged by jenkins-bot:

[mediawiki/extensions/ProofreadPage@master] Harden page number calculation to not run into PHP_INT_MAX

https://gerrit.wikimedia.org/r/725438

Maintenance_bot removed a project: Patch-For-Review.Oct 3 2021, 5:10 PM
Umherirrender closed this task as Resolved.Oct 22 2021, 5:37 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL