Page MenuHomePhabricator
Create Task
Maniphest T324207

Phan crashes on css-sanitizer on PHP 8.1
Closed, ResolvedPublic
Actions

Description

> phan -d . -p --allow-polyfill-parser
~/code/mediawiki-libs-css-sanitizer/vendor/mediawiki/phan-taint-check-plugin/src/Taintedness.php:472 [8192] Implicit conversion from float 1.2 to int loses precision
(Phan 5.2.0 crashed when parsing/analyzing 'tests/Objects/CSSObjectListTest.php')
More details:
#2: SecurityCheckPlugin\Taintedness->getTaintednessForOffsetOrWhole() called at [~/code/mediawiki-libs-css-sanitizer/vendor/mediawiki/phan-taint-check-plugin/src/TaintednessVisitor.php:703] Args: [1.2]
#3: SecurityCheckPlugin\TaintednessVisitor->visitDim() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/Plugin/ConfigPluginSet.php:1297] Args: [ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}})]
#4: SecurityCheckPlugin\MWVisitor::Phan\Plugin\{closure}() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/Plugin/ConfigPluginSet.php:323] Args: [Phan\CodeBase({}), Phan\Language\Context(tests/Objects/CSSObjectListTest.php:290), ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}), [ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"ki...
#5: Phan\Plugin\ConfigPluginSet->postAnalyzeNode() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:3216] Args: [Phan\CodeBase({}), Phan\Language\Context(tests/Objects/CSSObjectListTest.php:290), ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}), [ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"...
#6: Phan\BlockAnalysisVisitor->postOrderAnalyze() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:600] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:290), ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}})]
#7: Phan\BlockAnalysisVisitor->visit() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:191] Args: [ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}})]
#8: Phan\AST\Visitor\KindVisitorImplementation->visitDim() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}})]
#9: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:597] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:290), ast\Node({"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}}), ast\Node({"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}})]
#10: Phan\BlockAnalysisVisitor->visit() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:70] Args: [ast\Node({"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}})]
#11: Phan\AST\Visitor\KindVisitorImplementation->visitAssign() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}})]
#12: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:290), ast\Node({"kind":132,"flags":0,"lineno":289,"children":[{"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}},{"kind":768,"flags":0,"lineno":291,"children":{"expr":{"kind":256,"flags":0,"lineno":291,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":291,"children":["Expected exception not thrown"]}}}]}), ast\Node({"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"line...
#13: Phan\BlockAnalysisVisitor->visitStmtList() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":132,"flags":0,"lineno":289,"children":[{"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}},{"kind":768,"flags":0,"lineno":291,"children":{"expr":{"kind":256,"flags":0,"lineno":291,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":291,"children":["Expected exception not thrown"]}}}]})]
#14: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:2498] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:290), ast\Node({"kind":772,"flags":0,"lineno":289,"children":{"try":{"kind":132,"flags":0,"lineno":289,"children":[{"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}},{"kind":768,"flags":0,"lineno":291,"children":{"expr":{"kind":256,"flags":0,"lineno":291,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":291,"children":["Expected exception not thrown"]}}}]},"catches":{"kind":135,"flags":0,"lineno":292,"children":[{"kind":773,"flags":0,"lineno":292,"children":{"class":{"kind":141,"fla...
#15: Phan\BlockAnalysisVisitor->visitTry() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":772,"flags":0,"lineno":289,"children":{"try":{"kind":132,"flags":0,"lineno":289,"children":[{"kind":518,"flags":0,"lineno":290,"children":{"var":{"kind":256,"flags":1879048192,"lineno":290,"children":{"name":"dummy"},"taint":{}},"expr":{"kind":512,"flags":0,"lineno":290,"children":{"expr":{"kind":256,"flags":0,"lineno":290,"children":{"name":"list"},"taint":{}},"dim":1.2}}}},{"kind":768,"flags":0,"lineno":291,"children":{"expr":{"kind":256,"flags":0,"lineno":291,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":291,"children":["Expected exception not thrown"]}}}]},"catches":{"kind":135,"flags":0,"lineno":292,"children":[{"kind":773,"flags":0,"lineno":292,"children":{"class":{"kind":141,"flags":0,"lineno":292,"children":[{"kind":2048,"flags":1,"lineno":292,"children":{"name...
#16: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:289), ast\Node({"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":253,"children":{"class":{"kind":2048,"flags":1,"lineno":253,"children":{"name":"TestCSSObjec...
#17: Phan\BlockAnalysisVisitor->visitStmtList() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":253,"children":{"class":{"kind":2048,"flags":1,"lineno":253,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":253,"children":...
#18: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:3097] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:271), ast\Node({"kind":69,"flags":1,"lineno":251,"children":{"name":"testArrayAccess","docComment":null,"params":{"kind":136,"flags":0,"lineno":251,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2...
#19: Phan\BlockAnalysisVisitor->visitMethod() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":69,"flags":1,"lineno":251,"children":{"name":"testArrayAccess","docComment":null,"params":{"kind":136,"flags":0,"lineno":251,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":253,"children":{...
#20: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:251), ast\Node({"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":20,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{},"hash":null},{"kind":768,"flags":0,"lineno":21,"children":{"expr":{"kind":256,"flags":0,"li...
#21: Phan\BlockAnalysisVisitor->visitStmtList() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":20,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{},"hash":null},{"kind":768,"flags":0,"lineno":21,"children":{"expr":{"kind":256,"flags":0,"lineno":21,"children":{"name":"this"},"taint":{},"hash":null},"method":"expectEx...
#22: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:1537] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:251), ast\Node({"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjectList\n */","extends":{"kind":2048,"flags":1,"lineno":17,"children":{"name":"TestCase"}},"implements":null,"stmts":{"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"...
#23: Phan\BlockAnalysisVisitor->visitClosedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:3065] Args: [ast\Node({"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjectList\n */","extends":{"kind":2048,"flags":1,"lineno":17,"children":{"name":"TestCase"}},"implements":null,"stmts":{"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":12...
#24: Phan\BlockAnalysisVisitor->visitClass() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:628] Args: [ast\Node({"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjectList\n */","extends":{"kind":2048,"flags":1,"lineno":17,"children":{"name":"TestCase"}},"implements":null,"stmts":{"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags"...
#25: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:17), ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"flags":1,"lineno":12,"children":[{"kind":543,"flags":0,"lineno":12,"children":{"name":"Wikimedia\\CSS\\Util","alias":null}}]},{"kind":70,"flags":0,"lineno":17,"chi...
#26: Phan\BlockAnalysisVisitor->visitStmtList() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:35] Args: [ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"flags":1,"lineno":12,"children":[{"kind":543,"flags":0,"lineno":12,"children":{"name":"Wikimedia\\CSS\\Util","alias":null}}]},{"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @cov...
#27: Phan\AST\Visitor\KindVisitorImplementation->__invoke() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/Analysis.php:578] Args: [ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"flags":1,"lineno":12,"children":[{"kind":543,"flags":0,"lineno":12,"children":{"name":"Wikimedia\\CSS\\Util","alias":null}}]},{"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\...
#28: Phan\Analysis::analyzeFile() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/Phan.php:535] Args: [Phan\CodeBase({}), "tests/Objects/CSSObjectListTest.php", null, null]
#29: Phan\Phan::Phan\{closure}() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/Phan.php:592] Args: [69, "tests/Objects/CSSObjectListTest.php", 121]
#30: Phan\Phan::finishAnalyzingRemainingStatements() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/Phan/Phan.php:384] Args: [Phan\CodeBase({}), null, ["src/Grammar/Matcher.php", "src/Grammar/Alternative.php", "src/Grammar/AnythingMatcher.php", "src/Grammar/BlockMatcher.php", "src/Grammar/CheckedMatcher.php", "src/Grammar/DelimMatcher.php", "src/Grammar/FunctionMatcher.php", "src/Grammar/Juxtaposition.php", "src/Grammar/KeywordMatcher.php", "src/Grammar/NoWhitespace.php", ... 111 more element(s)], []]
#31: Phan\Phan::analyzeFileList() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/phan.php:38] Args: [Phan\CodeBase({}), Closure]
#32: require_once() called at [~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/phan:10] Args: ["~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/src/phan.php"]
#33: include() called at [~/code/mediawiki-libs-css-sanitizer/vendor/bin/phan:120] Args: ["~/code/mediawiki-libs-css-sanitizer/vendor/phan/phan/phan"]

Happens on mediawiki-phan-config 0.12.0 and 0.11.1, so was not fixed by T311452: Taint Check Plugin release as previously suspected.

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
Update mediawiki-phan-config, exclude problematic file from analysiscss-sanitizermaster+5 -2
Bump phan/phan to 5.4.2mediawiki/tools/phan/SecurityCheckPluginmaster+4 -1
Customize query in gerrit

Related Objects

Event Timeline

Jdforrester-WMF created this task.Dec 1 2022, 2:13 PM
• Tgr mentioned this in T307504: Implicit conversion from float 1.2 to int loses precision.Dec 3 2022, 4:01 AM
Umherirrender added a project: Upstream.Dec 15 2022, 5:53 PM
In T307504#8471623, @Umherirrender wrote:

While testing with the above example I have found also an issue upstream - https://github.com/phan/phan/issues/4749

According to a fresh run on css-sanitizer for php8.1 that is also the current failure

https://integration.wikimedia.org/ci/job/composer-package-php81-docker/1678/console

/src/vendor/phan/phan/src/Phan/Analysis/AssignmentVisitor.php:881 [8192] Implicit conversion from float 1.2 to int loses precision
 (Phan 5.4.1 crashed when parsing/analyzing 'tests/Objects/CSSObjectListTest.php')
 More details:
 #2: Phan\Analysis\AssignmentVisitor->visitDim() called at [/src/vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:35] Args: [ast\Node({"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}})]
 #3: Phan\AST\Visitor\KindVisitorImplementation->__invoke() called at [/src/vendor/phan/phan/src/Phan/Analysis/PostOrderAnalysisVisitor.php:174] Args:

Needs to wait for upstream fix and release.

Umherirrender moved this task from Backlog to Other on the PHP 8.1 support board.Dec 16 2022, 4:00 PM
Reedy mentioned this in T326476: Next mediawiki-phan-config release.Jan 7 2023, 5:12 PM
Reedy moved this task from Unsorted to External on the css-sanitizer board.Jan 8 2023, 11:38 PM
Reedy moved this task from Backlog to Reported Upstream on the Upstream board.
Jdforrester-WMF added a comment.Jan 10 2023, 6:13 PM

I assume that the upstream issue is https://github.com/phan/phan/issues/4749 and not a different one? (There's not been an upstream release since the 5.4.1 one we're currently using.)

• Tgr subscribed.EditedJan 11 2023, 3:39 AM

Or just fix the taint-check bug that won't actually be fixed by the upstream patch (if Taintedness behaved correctly, it didn't trigger an implicit conversion since that's not a thing for ArrayAccess objects) and then the phan bug about array indexes won't be relevant here.

Umherirrender unsubscribed.Mar 13 2023, 7:53 PM
Michael subscribed.EditedJul 14 2023, 9:14 AM

Note that phan 5.4.2 was released back in March, and in CI we're still using 5.4.1. Not sure if it fixes the issue, but we might at least get an idea about how the latest version behaves.

I don't seem to have the rights to upload changes for mediawiki/tools/phan on Gerrit, otherwise I would have offered one for review.

(Also, the phan codebase has seen no activity since March, and its main developer seems to have taken a break from open source work. Not sure what to make of that :/ )

Reedy added a comment.Jul 14 2023, 11:18 AM
In T324207#9014896, @Michael wrote:

I don't seem to have the rights to upload changes for mediawiki/tools/phan on Gerrit, otherwise I would have offered one for review.

What error are you getting?

It should be like all of our repos, and you can definitely submit to others fine...

Michael added a comment.EditedJul 14 2023, 1:26 PM
In T324207#9015126, @Reedy wrote:
In T324207#9014896, @Michael wrote:

I don't seem to have the rights to upload changes for mediawiki/tools/phan on Gerrit, otherwise I would have offered one for review.

What error are you getting?

It should be like all of our repos, and you can definitely submit to others fine...

It had complained about "public key denied", but that was my bad. Somehow, the toggle above when copying the line to clone the plugin with hook must have moved away from ssh and thus the usual workflow didn't work. I then got misled by the access tab. All good now.

Just CI is failing, because I also need to bump the phan version in mediawiki/phan-taint-check-plugin 🙃.

I'll look more into this later today.

gerritbot added a comment.Jul 14 2023, 2:20 PM

Change 938249 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan/phan to 5.4.2

https://gerrit.wikimedia.org/r/938249

gerritbot added a project: Patch-For-Review.Jul 14 2023, 2:20 PM
Daimona mentioned this in T326475: Next phan-taint-check-plugin release.Jul 14 2023, 2:24 PM
gerritbot added a comment.Jul 14 2023, 2:24 PM

Change 938249 merged by jenkins-bot:

[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan/phan to 5.4.2

https://gerrit.wikimedia.org/r/938249

Daimona added a comment.Jul 14 2023, 2:29 PM

I've looked at this again... Phan 5.4.2 still has the bug reported in T324207#8471710. That's causing phan to fail on css-sanitizer. The issue in taint-check was already fixed for T307504 and it no longer crashes on css-sanitizer. I don't think we can do anything here without an upstream release.

Maintenance_bot removed a project: Patch-For-Review.Jul 14 2023, 2:30 PM
Daimona mentioned this in T332611: Upgrade Wikimedia OCR to Bookworm and PHP 8.2.Aug 29 2023, 11:24 AM
TK-999 subscribed.Oct 13 2023, 4:07 PM

Might be worth to manually patch the affected plugin in CI—Phan seems to have been in development limbo for most of this year, there is very little activity both in terms of code changes and responding to issues.

• Tgr added a comment.Oct 13 2023, 7:49 PM
In T324207#9015605, @Daimona wrote:

I've looked at this again... Phan 5.4.2 still has the bug reported in T324207#8471710. That's causing phan to fail on css-sanitizer. The issue in taint-check was already fixed for T307504 and it no longer crashes on css-sanitizer.

It actually wasn't, as I noted above.

Daimona added a comment.Oct 13 2023, 8:07 PM
In T324207#9250907, @Tgr wrote:
In T324207#9015605, @Daimona wrote:

I've looked at this again... Phan 5.4.2 still has the bug reported in T324207#8471710. That's causing phan to fail on css-sanitizer. The issue in taint-check was already fixed for T307504 and it no longer crashes on css-sanitizer.

It actually wasn't, as I noted above.

This is what I get using mw-phan-config 0.13.0 (taint-check 5.0.0, phan 5.4.2):

$ php8.1 vendor/bin/phan
vendor/phan/phan/src/Phan/Analysis/AssignmentVisitor.php:881 [8192] Implicit conversion from float 1.2 to int loses precision
(Phan 5.4.2 crashed when parsing/analyzing 'tests/Objects/CSSObjectListTest.php')
More details:
#2: Phan\Analysis\AssignmentVisitor->visitDim() called at [vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:35] Args: [ast\Node({"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}})]
#3: Phan\AST\Visitor\KindVisitorImplementation->__invoke() called at [vendor/phan/phan/src/Phan/Analysis/PostOrderAnalysisVisitor.php:174] Args: [ast\Node({"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}})]
#4: Phan\Analysis\PostOrderAnalysisVisitor->visitAssign() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:3225] Args: [ast\Node({"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}})]
#5: Phan\BlockAnalysisVisitor->postOrderAnalyze() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:610] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:321), ast\Node({"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}})]
#6: Phan\BlockAnalysisVisitor->visit() called at [vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:70] Args: [ast\Node({"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}})]
#7: Phan\AST\Visitor\KindVisitorImplementation->visitAssign() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}})]
#8: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:321), ast\Node({"kind":132,"flags":0,"lineno":320,"children":[{"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}},{"kind":768,"flags":0,"lineno":322,"children":{"expr":{"kind":256,"flags":0,"lineno":322,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":322,"children":["Expected exception not thrown"]}}}]}), ast\Node({"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"...
#9: Phan\BlockAnalysisVisitor->visitStmtList() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":132,"flags":0,"lineno":320,"children":[{"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}},{"kind":768,"flags":0,"lineno":322,"children":{"expr":{"kind":256,"flags":0,"lineno":322,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":322,"children":["Expected exception not thrown"]}}}]})]
#10: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:2507] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:321), ast\Node({"kind":772,"flags":0,"lineno":320,"children":{"try":{"kind":132,"flags":0,"lineno":320,"children":[{"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}},{"kind":768,"flags":0,"lineno":322,"children":{"expr":{"kind":256,"flags":0,"lineno":322,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":322,"children":["Expected exception not thrown"]}}}]},"catches":{"kind":135,"flags":0,"lineno":323,"children":[{"kind":773,"flags":0,"lineno":323,"children":{"class":{"kind":141,"flags...
#11: Phan\BlockAnalysisVisitor->visitTry() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":772,"flags":0,"lineno":320,"children":{"try":{"kind":132,"flags":0,"lineno":320,"children":[{"kind":518,"flags":0,"lineno":321,"children":{"var":{"kind":512,"flags":1879048192,"lineno":321,"children":{"expr":{"kind":256,"flags":1610612736,"lineno":321,"children":{"name":"list"},"taint":{}},"dim":1.2},"taint":{}},"expr":{"kind":256,"flags":0,"lineno":321,"children":{"name":"value6"},"taint":{}}}},{"kind":768,"flags":0,"lineno":322,"children":{"expr":{"kind":256,"flags":0,"lineno":322,"children":{"name":"this"}},"method":"fail","args":{"kind":128,"flags":0,"lineno":322,"children":["Expected exception not thrown"]}}}]},"catches":{"kind":135,"flags":0,"lineno":323,"children":[{"kind":773,"flags":0,"lineno":323,"children":{"class":{"kind":141,"flags":0,"lineno":323,"children":[{"kind":2048,"flags":1,"lineno":323,"children":{"name":...
#12: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:320), ast\Node({"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":253,"children":{"class":{"kind":2048,"flags":1,"lineno":253,"children":{"name":"TestCSSObjectListItem"},"hash":null...
#13: Phan\BlockAnalysisVisitor->visitStmtList() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":253,"children":{"class":{"kind":2048,"flags":1,"lineno":253,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":253,"children":[2],"hash":null}},"tain...
#14: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:3113] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:271), ast\Node({"kind":69,"flags":1,"lineno":251,"children":{"name":"testArrayAccess","docComment":null,"params":{"kind":136,"flags":0,"lineno":251,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":nu...
#15: Phan\BlockAnalysisVisitor->visitMethod() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":69,"flags":1,"lineno":251,"children":{"name":"testArrayAccess","docComment":null,"params":{"kind":136,"flags":0,"lineno":251,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":251,"children":[{"kind":518,"flags":0,"lineno":252,"children":{"var":{"kind":256,"flags":1879048192,"lineno":252,"children":{"name":"value1"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":252,"children":{"class":{"kind":2048,"flags":1,"lineno":252,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":252,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{}},{"kind":518,"flags":0,"lineno":253,"children":{"var":{"kind":256,"flags":1879048192,"lineno":253,"children":{"name":"value2"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":253,"children":{"class":{"kind":2048,"f...
#16: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:251), ast\Node({"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":20,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{},"hash":null},{"kind":768,"flags":0,"lineno":21,"children":{"expr":{"kind":256,"flags":0,"lineno":21,"children":{"n...
#17: Phan\BlockAnalysisVisitor->visitStmtList() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":20,"children":[1],"hash":null}},"taint":{},"hash":null}},"taint":{},"hash":null},{"kind":768,"flags":0,"lineno":21,"children":{"expr":{"kind":256,"flags":0,"lineno":21,"children":{"name":"this"},"taint":{},"hash":null},"method":"expectException","args":{"kind"...
#18: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:1546] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:251), ast\Node({"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjectList\n */","extends":{"kind":2048,"flags":1,"lineno":17,"children":{"name":"TestCase"}},"implements":null,"stmts":{"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"Test...
#19: Phan\BlockAnalysisVisitor->visitClosedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:3081] Args: [ast\Node({"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjectList\n */","extends":{"kind":2048,"flags":1,"lineno":17,"children":{"name":"TestCase"}},"implements":null,"stmts":{"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":20...
#20: Phan\BlockAnalysisVisitor->visitClass() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:638] Args: [ast\Node({"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjectList\n */","extends":{"kind":2048,"flags":1,"lineno":17,"children":{"name":"TestCase"}},"implements":null,"stmts":{"kind":132,"flags":0,"lineno":17,"children":[{"kind":69,"flags":1,"lineno":19,"children":{"name":"testException","docComment":null,"params":{"kind":136,"flags":0,"lineno":19,"children":[]},"stmts":{"kind":132,"flags":0,"lineno":19,"children":[{"kind":518,"flags":0,"lineno":20,"children":{"var":{"kind":256,"flags":1879048192,"lineno":20,"children":{"name":"item"},"taint":{},"hash":null},"expr":{"kind":527,"flags":0,"lineno":20,"children":{"class":{"kind":2048,"flags":1,"lineno":20,"children":{"name":"TestCSSObjectListItem"},"hash":null},"args":{"kind":128,"flags":0,"lineno":20,"childre...
#21: Phan\BlockAnalysisVisitor->analyzeAndGetUpdatedContext() called at [vendor/phan/phan/src/Phan/BlockAnalysisVisitor.php:240] Args: [Phan\Language\Context(tests/Objects/CSSObjectListTest.php:17), ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"flags":1,"lineno":12,"children":[{"kind":543,"flags":0,"lineno":12,"children":{"name":"Wikimedia\\CSS\\Util","alias":null}}]},{"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObje...
#22: Phan\BlockAnalysisVisitor->visitStmtList() called at [vendor/phan/phan/src/Phan/AST/Visitor/KindVisitorImplementation.php:35] Args: [ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"flags":1,"lineno":12,"children":[{"kind":543,"flags":0,"lineno":12,"children":{"name":"Wikimedia\\CSS\\Util","alias":null}}]},{"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\O...
#23: Phan\AST\Visitor\KindVisitorImplementation->__invoke() called at [vendor/phan/phan/src/Phan/Analysis.php:583] Args: [ast\Node({"kind":132,"flags":0,"lineno":1,"children":[{"kind":542,"flags":0,"lineno":7,"children":{"name":"Wikimedia\\CSS\\Objects","stmts":null}},{"kind":143,"flags":1,"lineno":9,"children":[{"kind":543,"flags":0,"lineno":9,"children":{"name":"InvalidArgumentException","alias":null}}]},{"kind":143,"flags":1,"lineno":10,"children":[{"kind":543,"flags":0,"lineno":10,"children":{"name":"OutOfBoundsException","alias":null}}]},{"kind":143,"flags":1,"lineno":11,"children":[{"kind":543,"flags":0,"lineno":11,"children":{"name":"PHPUnit\\Framework\\TestCase","alias":null}}]},{"kind":143,"flags":1,"lineno":12,"children":[{"kind":543,"flags":0,"lineno":12,"children":{"name":"Wikimedia\\CSS\\Util","alias":null}}]},{"kind":70,"flags":0,"lineno":17,"children":{"name":"CSSObjectListTest","docComment":"/**\n * @covers \\Wikimedia\\CSS\\Objects\\CSSObjec...
#24: Phan\Analysis::analyzeFile() called at [vendor/phan/phan/src/Phan/Phan.php:536] Args: [Phan\CodeBase({}), "tests/Objects/CSSObjectListTest.php", null, null]
#25: Phan\Phan::Phan\{closure}() called at [vendor/phan/phan/src/Phan/Phan.php:593] Args: [69, "tests/Objects/CSSObjectListTest.php", 121]
#26: Phan\Phan::finishAnalyzingRemainingStatements() called at [vendor/phan/phan/src/Phan/Phan.php:385] Args: [Phan\CodeBase({}), null, ["src/Grammar/Matcher.php", "src/Grammar/Alternative.php", "src/Grammar/AnythingMatcher.php", "src/Grammar/BlockMatcher.php", "src/Grammar/CheckedMatcher.php", "src/Grammar/DelimMatcher.php", "src/Grammar/FunctionMatcher.php", "src/Grammar/Juxtaposition.php", "src/Grammar/KeywordMatcher.php", "src/Grammar/NoWhitespace.php", ... 111 more element(s)], []]
#27: Phan\Phan::analyzeFileList() called at [vendor/phan/phan/src/phan.php:38] Args: [Phan\CodeBase({}), Closure]
#28: require_once() called at [vendor/phan/phan/phan:10] Args: ["vendor/phan/phan/src/phan.php"]
#29: include() called at [vendor/bin/phan:120] Args: ["vendor/phan/phan/phan"]
(Some long strings (usually JSON of AST Nodes) were truncated. To print more details for some stack frames of this crash, increase the Phan config setting debug_max_frame_length)

And I get the same error if I disable taint-check completely. Clearly this cannot be caused by taint-check. As demonstrated in https://github.com/phan/phan/issues/4749, this crash can be reproduced in phan itself.

It is absolutely true that taint-check treats array and array-like objects the same way, assuming that the array case is by far the most common. While it would be nice to fix that as noted in T324207#8515530, its only consequence should be lower accuracy when analyzing array-like objects, but it should never result in a crash. There might be scenarios where it does and that haven't been found thus far, but that's not what's causing the crash on css-sanitizer.

In T324207#9250385, @TK-999 wrote:

Might be worth to manually patch the affected plugin in CI—Phan seems to have been in development limbo for most of this year, there is very little activity both in terms of code changes and responding to issues.

Taint-check is fully under our control, but it's not causing this crash as per above. This is a bug in phan itself. But unfortunately I agree with the second part of your comment. Phan is all but actively maintained at the moment, and this is already causing us troubles (T325321 immediately comes to mind).

• Tgr added a comment.Oct 14 2023, 3:04 AM

If I read the code correctly, it would just taint the entire array if does not know what to do with the index? You are right, that sounds like correct behavior.

Is this enough of a problem to just get rid of the css-sanititzer testcase? It doesn't provide much value. Or add the file to an exclude list?

Daimona added a comment.Oct 14 2023, 12:36 PM
In T324207#9251275, @Tgr wrote:

If I read the code correctly, it would just taint the entire array if does not know what to do with the index? You are right, that sounds like correct behavior.

Without looking at the code, my answer would've been that it knows that some element in the array is tainted, but it wouldn't know what its key is. In practice, this means this is almost the same as marking all the array as tainted; the main difference is that it knows that the key itself is not tainted.

But in reality, judging from this demo, it just casts the key to an integer (code). I think it would be better if it marked the key as unknown instead.

Is this enough of a problem to just get rid of the css-sanititzer testcase? It doesn't provide much value. Or add the file to an exclude list?

That's actually a very good point! I did not realize that the crash occurs on a test file. I think excluding the file from analysis would be the easiest thing to do here.

gerritbot added a comment.Oct 14 2023, 12:39 PM

Change 965856 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[css-sanitizer@master] Update mediawiki-phan-config, exclude problematic file from analysis

https://gerrit.wikimedia.org/r/965856

gerritbot added a project: Patch-For-Review.Oct 14 2023, 12:39 PM
Daimona claimed this task.Oct 14 2023, 12:40 PM
• Tgr added a comment.EditedOct 15 2023, 3:41 AM
In T324207#9251362, @Daimona wrote:

But in reality, judging from this demo, it just casts the key to an integer (code). I think it would be better if it marked the key as unknown instead.

For normal arrays, casting is what PHP does so it's correct. For ArrayAccess objects, I guess it depends on how generic you want to be. PHP doesn't place any restrictions on the semantics of such code; there is no guarantee, for example, that

$aa[1] = $a;
$b = $aa[1];
assert( $a === $b );

will pass. So technically you cannot say anything whatsoever about the taintedness of values you get via offsetGet(); you should probably analyze it as a normal function call. But in real-world use cases you are very likely to only encounter objects which follow the usual array semantics.

TK-999 added a comment.Oct 15 2023, 6:35 AM
In T324207#9250941, @Daimona wrote:

Taint-check is fully under our control, but it's not causing this crash as per above. This is a bug in phan itself. But unfortunately I agree with the second part of your comment. Phan is all but actively maintained at the moment, and this is already causing us troubles (T325321 immediately comes to mind).

Yea I was referring to Phan's DuplicateArrayKeyPlugin there, sorry for the confusion.

What's odd is that running Phan with -d 'error_reporting=E_ALL & ~E_DEPRECATED' does not seem to prevent the problem either, so patching might well be the only workaround till upstream gets around to fixing this.

Daimona added a comment.Oct 15 2023, 1:28 PM
In T324207#9251690, @Tgr wrote:
In T324207#9251362, @Daimona wrote:

But in reality, judging from this demo, it just casts the key to an integer (code). I think it would be better if it marked the key as unknown instead.

For normal arrays, casting is what PHP does so it's correct. For ArrayAccess objects, I guess it depends on how generic you want to be. [...] But in real-world use cases you are very likely to only encounter objects which follow the usual array semantics.

Yeah, I think it makes sense to assume the most common scenario of plain arrays, or array-like objects behaving the same as normal arrays. I guess what makes me uncertain is that if non-integer keys are deprecated in PHP 8.1, then I would assume that the most common scenario when encountering a non-integer key would actually be the ArrayAccess one, if the code base claims PHP 8.1 support. But in that case, we wouldn't be able to infer the real float key because the internal representation uses arrays; and in turn, this means it would make more sense to mark the key as unknown. At any rate, I do think this is always going to be uncommon in real-world code.

In T324207#9251703, @TK-999 wrote:

What's odd is that running Phan with -d 'error_reporting=E_ALL & ~E_DEPRECATED' does not seem to prevent the problem either, so patching might well be the only workaround till upstream gets around to fixing this.

I think our best bet is to just stop analyzing the problematic file, which I've done in r965856. Being a test file, excluding it from analysis should be perfectly fine.

Jdforrester-WMF removed a parent task: T311451: Re-enable PHP 8.1 CI on css-sanitizer.Oct 18 2023, 6:05 PM
gerritbot added a comment.Oct 18 2023, 6:07 PM

Change 965856 merged by jenkins-bot:

[css-sanitizer@master] Update mediawiki-phan-config, exclude problematic file from analysis

https://gerrit.wikimedia.org/r/965856

Maintenance_bot removed a project: Patch-For-Review.Oct 18 2023, 6:10 PM
Daimona closed this task as Resolved.Oct 18 2023, 9:46 PM
Daimona mentioned this in rCSSS593f7e06a9e4: Update mediawiki-phan-config, exclude problematic file from analysis.Oct 18 2023, 11:08 PM
gerritbot added a comment.Jan 9 2024, 8:41 PM

Change 989247 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/tools/phan@master] [WIP] Bump phan/phan to 5.4.3

https://gerrit.wikimedia.org/r/989247

gerritbot added a project: Patch-For-Review.Jan 9 2024, 8:41 PM
Izno moved this task from External to Done on the css-sanitizer board.Apr 2 2024, 6:57 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits