The following AbuseFilter pages can be used to test out/examine filters against existing revisions. Ensure these pages don't accidentally reveal user_ip (eg. if /test uses user_ip in a filter, ensure it fails if the user shouldn't be able to use that variable.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Disallow protected variable access on AbuseFilterViewTestBatch | mediawiki/extensions/AbuseFilter | master | +86 -34 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Madalina | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Tchanders | T326869 Update TSP-owned products that may be affected by IP Masking | |||
| Resolved | • lbowmaker | T262321 IP Masking | |||
| Resolved | tstarling | T300263 [IP Masking] Create temporary account on first edit | |||
| Open | None | T307060 [Epic] Temporary account AbuseFilter support | |||
| Resolved | STran | T357772 Investigate: How will `ip_in_range` and `ip_in_ranges` function when temporary accounts are enabled | |||
| Resolved | STran | T363906 [Epic] Ensure filters that use PII-sensitive variables are protected | |||
| Resolved | STran | T364834 Ensure testing tools that use `user_unnamed_ip` don't reveal it to users without the view right |
I ran the following tests using accounts with no permissions (logged out), view private only, and view private + protected:
on /test (no change needed):
on /examine (no change needed):
on /tools (no change needed):
on filter pages (no change needed):
As part of due diligence, I also grepped for other pages in case they were also possible leaks. Most of these were covered by the patch that implemented the protected variable concept but I'll note them here just so it's somewhere:
$ find . | grep AbuseFilterView ./includes/View/AbuseFilterView.php // Base class ./includes/View/AbuseFilterViewTestBatch.php // /test page, see above ./includes/View/AbuseFilterViewList.php // Main page, shows protected filters, hides hits as expected ./includes/View/AbuseFilterViewHistory.php // List of filter changes, hides protected filters as expected ./includes/View/AbuseFilterViewTools.php // /tools, see above ./includes/View/AbuseFilterViewDiff.php // Diff in filter changes, hidden from unprivileged user ./includes/View/AbuseFilterViewExamine.php // /examine, see above ./includes/View/AbuseFilterViewEdit.php // Filter edit page, hidden as expected ./includes/View/AbuseFilterViewImport.php // Import filter page, no revisions ./includes/View/AbuseFilterViewRevert.php // Filter action revert, that the filter has been tripped can be seen (assuming you have revert rights) even if it uses protected vars but this matches the existing private/hidden behavior
@STran I find that if I go to Special:AbuseFilter/test/<id> I can see the rules for the filter even if I do not have permissions to see them going to Special:AbuseFilter/<id>.
Change #1042228 had a related patch set uploaded (by STran; author: STran):
[mediawiki/extensions/AbuseFilter@master] Add protected variable view permission rights
Change #1052753 had a related patch set uploaded (by STran; author: STran):
[mediawiki/extensions/AbuseFilter@master] Disallow protected variable access on AbuseFilterViewTestBatch
Change #1052753 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Disallow protected variable access on AbuseFilterViewTestBatch