There have been close to 1000 validation errors for events submitted to the mediawiki.editattempt_block stream in the last week (see https://logstash.wikimedia.org/goto/c6e05b596528d6b14ba0863ca423a187). All of the errors are related to spurious values in the interface property of the event, some of which are attempts at injections, e.g.

• visualeditor'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'
• yi4AyyfN')) OR 756=(SELECT 756 FROM PG_SLEEP(15))--

The wikimediaeventsblockededit Action API query module defines an interface parameter. During execution, the query module fetches the value of the parameter and passes it to BlockUtils::logBlockedEditAttempt( $user, $title, $interface, $platform ). BlockUtils::logBlockedEditAttempt() submits an event with the interface property set to $interface.

The solution would be to either use the parameter validation baked into the Action API or to update BlockUtils::logBlockedEditAttempt() to validate both the $interface and $platform parameters before submitting an event. Either way, the allowed values for interface parameter are limited (see https://gerrit.wikimedia.org/g/schemas/event/secondary/+/192e1a497d16b3da22817177e7676e342a4494a7/jsonschema/analytics/mediawiki/editattemptsblocked/current.yaml#44).