Page MenuHomePhabricator
Create Task
Maniphest T392086

PHP Warning: Array to string conversion / RuntimeException: PCRE failure on Special:PasswordReset
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

Error
normalized_message
[{reqId}] {exception_url}   PHP Warning: Array to string conversion
FrameLocationCall
from/srv/mediawiki/php-1.44.0-wmf.25/includes/GlobalFunctions.php(1164)
#0/srv/mediawiki/php-1.44.0-wmf.25/includes/GlobalFunctions.php(1164)MediaWiki\Exception\MWExceptionHandler::handleError(int, string, string, int)
#1/srv/mediawiki/php-1.44.0-wmf.25/includes/specials/SpecialPasswordReset.php(169)wfEscapeWikiText(array)
#2/srv/mediawiki/php-1.44.0-wmf.25/includes/specialpage/FormSpecialPage.php(216)MediaWiki\Specials\SpecialPasswordReset->onSuccess()
#3/srv/mediawiki/php-1.44.0-wmf.25/includes/specials/SpecialPasswordReset.php(74)MediaWiki\SpecialPage\FormSpecialPage->execute(null)
#4/srv/mediawiki/php-1.44.0-wmf.25/includes/specialpage/SpecialPage.php(729)MediaWiki\Specials\SpecialPasswordReset->execute(null)
#5/srv/mediawiki/php-1.44.0-wmf.25/includes/specialpage/SpecialPageFactory.php(1738)MediaWiki\SpecialPage\SpecialPage->run(null)
#6/srv/mediawiki/php-1.44.0-wmf.25/includes/actions/ActionEntryPoint.php(499)MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#7/srv/mediawiki/php-1.44.0-wmf.25/includes/actions/ActionEntryPoint.php(143)MediaWiki\Actions\ActionEntryPoint->performRequest()
#8/srv/mediawiki/php-1.44.0-wmf.25/includes/MediaWikiEntryPoint.php(202)MediaWiki\Actions\ActionEntryPoint->execute()
#9/srv/mediawiki/php-1.44.0-wmf.25/index.php(58)MediaWiki\MediaWikiEntryPoint->run()
#10/srv/mediawiki/w/index.php(3)require(string)
#11{main}
Impact
Notes

I see these for numerous private/internal wikis...

rMWa3f4f7bbbbe4: wfEscapeWikiText: Don't choke if the replaced wikitext is empty was in the area, but not sure actually related in practice.

Error
normalized_message
[{reqId}] {exception_url}   RuntimeException: PCRE failure
FrameLocationCall
from/srv/mediawiki/php-1.44.0-wmf.25/includes/parser/Parser.php(2176)
#0/srv/mediawiki/php-1.44.0-wmf.25/includes/parser/Parser.php(1636)MediaWiki\Parser\Parser->handleExternalLinks(string)
#1/srv/mediawiki/php-1.44.0-wmf.25/includes/parser/Parser.php(705)MediaWiki\Parser\Parser->internalParse(string)
#2/srv/mediawiki/php-1.44.0-wmf.25/includes/language/MessageParser.php(191)MediaWiki\Parser\Parser->parse(string, MediaWiki\Title\Title, MediaWiki\Parser\ParserOptions, bool)
#3/srv/mediawiki/php-1.44.0-wmf.25/includes/language/MessageParser.php(156)MediaWiki\Language\MessageParser->parseWithoutPostprocessing(string, MediaWiki\Title\Title, bool, bool, LanguageEn)
#4/srv/mediawiki/php-1.44.0-wmf.25/includes/language/Message/Message.php(1506)MediaWiki\Language\MessageParser->parse(string, MediaWiki\Title\Title, bool, bool, LanguageEn)
#5/srv/mediawiki/php-1.44.0-wmf.25/includes/language/Message/Message.php(1099)MediaWiki\Message\Message->parseText(string)
#6/srv/mediawiki/php-1.44.0-wmf.25/includes/language/Message/Message.php(1175)MediaWiki\Message\Message->format(string)
#7/srv/mediawiki/php-1.44.0-wmf.25/includes/Output/OutputPage.php(5060)MediaWiki\Message\Message->parseAsBlock()
#8/srv/mediawiki/php-1.44.0-wmf.25/includes/Output/OutputPage.php(5047)MediaWiki\Output\OutputPage->addWikiMsgArray(string, array)
#9/srv/mediawiki/php-1.44.0-wmf.25/includes/specials/SpecialPasswordReset.php(175)MediaWiki\Output\OutputPage->addWikiMsg(string, string)
#10/srv/mediawiki/php-1.44.0-wmf.25/includes/specialpage/FormSpecialPage.php(216)MediaWiki\Specials\SpecialPasswordReset->onSuccess()
#11/srv/mediawiki/php-1.44.0-wmf.25/includes/specials/SpecialPasswordReset.php(74)MediaWiki\SpecialPage\FormSpecialPage->execute(null)
#12/srv/mediawiki/php-1.44.0-wmf.25/includes/specialpage/SpecialPage.php(729)MediaWiki\Specials\SpecialPasswordReset->execute(null)
#13/srv/mediawiki/php-1.44.0-wmf.25/includes/specialpage/SpecialPageFactory.php(1738)MediaWiki\SpecialPage\SpecialPage->run(null)
#14/srv/mediawiki/php-1.44.0-wmf.25/includes/actions/ActionEntryPoint.php(499)MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#15/srv/mediawiki/php-1.44.0-wmf.25/includes/actions/ActionEntryPoint.php(143)MediaWiki\Actions\ActionEntryPoint->performRequest()
#16/srv/mediawiki/php-1.44.0-wmf.25/includes/MediaWikiEntryPoint.php(202)MediaWiki\Actions\ActionEntryPoint->execute()
#17/srv/mediawiki/php-1.44.0-wmf.25/index.php(58)MediaWiki\MediaWikiEntryPoint->run()
#18/srv/mediawiki/w/index.php(3)require(string)
#19{main}
Impact
Notes

Details

Request URL
https://internal.wikimedia.org/wiki/Special:PasswordReset
Related Changes in Gerrit:
SubjectRepoBranchLines +/-
specials: Fix PHP Warning on Special:PasswordReset for crafted inputmediawiki/corewmf/1.44.0-wmf.25+26 -29
specials: Fix PHP Warning on Special:PasswordReset for crafted inputmediawiki/coreREL1_43+26 -29
specials: Fix PHP Warning on Special:PasswordReset for crafted inputmediawiki/coremaster+26 -29
specials: Add tests for Special:PasswordReset success pathmediawiki/coremaster+43 -0
Customize query in gerrit

Related Objects

Event Timeline

Reedy created this task.Apr 16 2025, 1:27 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 16 2025, 1:27 PM
Reedy updated the task description. (Show Details)Apr 16 2025, 1:29 PM
Reedy updated the task description. (Show Details)Apr 16 2025, 1:31 PM
Reedy added a parent task: T386220: 1.44.0-wmf.25 deployment blockers.Apr 16 2025, 1:59 PM
Reedy mentioned this in T386220: 1.44.0-wmf.25 deployment blockers.
Jdforrester-WMF triaged this task as Unbreak Now! priority.Apr 16 2025, 2:03 PM
Jdforrester-WMF subscribed.

Train blocker -> UBN.

Reedy renamed this task from PHP Warning: Array to string conversion to PHP Warning: Array to string conversion / RuntimeException: PCRE failure on Special:PasswordReset.Apr 16 2025, 3:11 PM
dduvall added a project: MediaWiki-Platform-Team.Apr 16 2025, 6:03 PM
dduvall lowered the priority of this task from Unbreak Now! to Medium.Apr 16 2025, 6:23 PM
dduvall subscribed.

Removing this task as a blocker as the errors only occurred during a short-ish window, occurred for wmf.24 as well as wmf.25, and only for internal wikis.

dduvall removed a parent task: T386220: 1.44.0-wmf.25 deployment blockers.Apr 16 2025, 6:23 PM
matmarex subscribed.EditedApr 16 2025, 6:26 PM

(mid-air collision with @dduvall)

The errors were on both wmf.24 and wmf.25. I don't think this is a train blocker or UBN.

https://logstash.wikimedia.org/goto/7757c6aaf0ee867872ab4c7e76e92236
https://logstash.wikimedia.org/goto/eac88888cf03fe86bba75f16801de19c

You have to tinker with the form submission params to cause this, this may be some unsolicited pentesting…

gerritbot added a comment.Apr 16 2025, 7:05 PM

Change #1137053 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/core@master] specials: Add tests for Special:PasswordReset success path

https://gerrit.wikimedia.org/r/1137053

gerritbot added a project: Patch-For-Review.Apr 16 2025, 7:05 PM

Change #1137054 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/core@master] specials: Fix PHP Warning on Special:PasswordReset for crafted input

https://gerrit.wikimedia.org/r/1137054

gerritbot added a comment.Apr 16 2025, 8:21 PM

Change #1137053 merged by jenkins-bot:

[mediawiki/core@master] specials: Add tests for Special:PasswordReset success path

https://gerrit.wikimedia.org/r/1137053

gerritbot added a comment.Apr 16 2025, 8:49 PM

Change #1137054 merged by jenkins-bot:

[mediawiki/core@master] specials: Fix PHP Warning on Special:PasswordReset for crafted input

https://gerrit.wikimedia.org/r/1137054

ReleaseTaggerBot added a project: MW-1.44-notes (1.44.0-wmf.27; 2025-04-29).Apr 16 2025, 9:00 PM
gerritbot added a comment.Apr 16 2025, 9:01 PM

Change #1137072 had a related patch set uploaded (by Reedy; author: Máté Szabó):

[mediawiki/core@REL1_43] specials: Fix PHP Warning on Special:PasswordReset for crafted input

https://gerrit.wikimedia.org/r/1137072

gerritbot added a comment.Apr 16 2025, 9:01 PM

Change #1137073 had a related patch set uploaded (by Reedy; author: Máté Szabó):

[mediawiki/core@wmf/1.44.0-wmf.25] specials: Fix PHP Warning on Special:PasswordReset for crafted input

https://gerrit.wikimedia.org/r/1137073

gerritbot added a comment.Apr 16 2025, 9:18 PM

Change #1137072 merged by jenkins-bot:

[mediawiki/core@REL1_43] specials: Fix PHP Warning on Special:PasswordReset for crafted input

https://gerrit.wikimedia.org/r/1137072

gerritbot added a comment.Apr 16 2025, 9:20 PM

Change #1137073 merged by jenkins-bot:

[mediawiki/core@wmf/1.44.0-wmf.25] specials: Fix PHP Warning on Special:PasswordReset for crafted input

https://gerrit.wikimedia.org/r/1137073

Stashbot added a comment.Apr 16 2025, 9:21 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-16T21:21:43Z] <reedy@deploy1003> Started scap sync-world: Backport for [[gerrit:1137073|specials: Fix PHP Warning on Special:PasswordReset for crafted input (T392086)]]

Stashbot added a comment.Apr 16 2025, 9:26 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-16T21:26:37Z] <reedy@deploy1003> reedy: Backport for [[gerrit:1137073|specials: Fix PHP Warning on Special:PasswordReset for crafted input (T392086)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Maintenance_bot removed a project: Patch-For-Review.Apr 16 2025, 9:31 PM
Stashbot added a comment.Apr 16 2025, 9:33 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-16T21:33:30Z] <reedy@deploy1003> Finished scap sync-world: Backport for [[gerrit:1137073|specials: Fix PHP Warning on Special:PasswordReset for crafted input (T392086)]] (duration: 11m 47s)

matmarex closed this task as Resolved.Apr 16 2025, 9:58 PM
ReleaseTaggerBot edited projects, added MW-1.43-notes, MW-1.44-notes (1.44.0-wmf.25; 2025-04-15); removed MW-1.44-notes (1.44.0-wmf.27; 2025-04-29).Apr 16 2025, 10:00 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits