Add hard-coded taints for ReplaceQueryBuilder similiar to InsertQueryBuilder
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Umherirrender
	Apr 1 2024, 9:41 PM

Project Tags

Referenced Files

None

Subscribers

Description

These functions needs special case in the taint code

to be handled similar to the same-named functions in InsertQueryBuilder (T253380 / 9b35afd537c804f9fc581b5453977846d40739d5)

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Add taints for \Wikimedia\Rdbms\ReplaceQueryBuilder::row/rows	Umherirrender	mediawiki/tools/phan/SecurityCheckPlugin	master	+8 -6

Mentioned In: T441355: Release a new version of mediawiki/tools/phan/SecurityCheckPlugin
Mentioned Here: rMTPS9b35afd537c8: Hardcode taintedness of InsertQueryBuilder::row() and ::rows()
T253380: Make taint-check understand all QueryBuilders

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 1 2024, 9:41 PM

Maybe this is not needed as there is no special handling for argument $rows for IDatabase::replace or IDatabase::upsert at the moment.

Change #1309722 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/tools/phan/SecurityCheckPlugin@master] Add taints for \Wikimedia\Rdbms\ReplaceQueryBuilder::row/rows

Umherirrender triaged this task as Low priority.

Change #1309722 merged by jenkins-bot:

[mediawiki/tools/phan/SecurityCheckPlugin@master] Add taints for \Wikimedia\Rdbms\ReplaceQueryBuilder::row/rows