This is because the UserAgentClientHintsHandler::getBodyValidator method isn't called if the content type is either application/x-www-form-urlencoded or mutlipart/form-data. This means that the UnsupportedContentTypeBodyValidator cannot be used as the method is never called and as such the "valid" data is used. When the data isn't valid (because it's a form data), the ::getValidatedBody method returns null. This was not accounted for.

The fix should just require checking that:

• The validated body is an array. If not, then:
  • If the content type is a form, then return a 415 with the message rest-unsupported-content-type
  • Otherwise return some 4XX with an appropriate message (this should be accounted for by ::getBodyValidator, but it makes sense to explicitly check for it to prevent other issues that may not be seen at the moment)

Re-producible on production wikis (Logstash single document). Impact is low as it would require a user sending a custom request to hit the server error.

Change 952187 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] clienthints: Handle non-array response from ::getValidatedBody

https://gerrit.wikimedia.org/r/952187

It seems that many other uses of ::getValidatedBody also assume an array will be returned if the JSON validator is used. While outside the scope of this task, the other usages will need to be fixed as I've seen a few in codesearch that would also cause a 500 server error if also given "form data" via setting the content type to a form.

Code search link: https://codesearch.wmcloud.org/search/?q=getValidatedBody&files=&excludeFiles=&repos=

Considering that the ::getValidatedBody method will also return null in many other cases (more than just the Content-Type check in Validator.php line 174), the usages of this method should explicitly be checking for null and return some kind of 4XX error when the validated body is null.

Change 952187 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] clienthints: Handle non-array response from ::getValidatedBody

https://gerrit.wikimedia.org/r/952187

I can no longer reproduce the bug in the description.

Instead, the API returns:

{"errorKey":"rest-unsupported-content-type","messageTranslations":{"en":"Unsupported Content-Type: application/x-www-form-urlencoded"},"httpCode":415,"httpReason":"Unsupported Media Type"}

I attacked the client hints API using OWASP ZAP which, among other things, modifies the Content-Type of the request header. I did not see any 500 responses or exceptions in the logs.

Test environment: CheckUser 2.5 (9ed2b65) 19:12, 29 August 2023.