Author: kahrl

Description:
If a string starts with a newline but does trigger any other condition in Spyc::_needLiteral(), Spyc fails to write it to the YAML output as a literal (i.e. starting with |- and properly escaped). This is because strpos( $value, "\n" ) returns 0, which is interpreted as false. This bug causes Perl's YAML module and possibly other loaders to choke on the YAML.

The trivial fix is to change line 167 of phase3/includes/libs/spyc.php from

strpos( $value, "\n" ) ||

to

strpos( $value, "\n" ) !== false ||

Example of a query that triggers this bug:

http://de.guttenplag.wikia.com/api.php?action=query&format=yaml&prop=revisions&rvprop=content&titles=Benutzer:Kahrl/YamlBug

Example of a query that triggers but does not show this bug (because there's also a # in the string):

http://de.guttenplag.wikia.com/api.php?action=query&format=yaml&prop=revisions&rvprop=content&titles=Benutzer:Kahrl/YamlBug2

Version: 1.18.x
Severity: normal