Page MenuHomePhabricator

Check HTMLForm's validation-callback in taint-check
Open, Needs TriagePublic

Description

The callback arguments are unsafe (form values) and the return value must be safe for HTML. See also T395622.

Event Timeline

This is currently not easy to do because we don't have a general-purpose way to check function-likes: handleMethodCall does a million things and is very reliant on having argument nodes. Some places (like for getQueryInfo handling) use it anyway but it's messy.

Test case I prepared:

$unsafeValidationCallback_noArgs = [
	'type' => 'text',
	'validation-callback' => static function() {
		return $_GET['a'];
	}
];

$unsafeValidationCallback_oneArg = [
	'type' => 'text',
	'validation-callback' => static function ( $value ) {
		echo $value;
		return $value;
	}
];

$unsafeValidationCallback_twoArgs = [
	'type' => 'text',
	'validation-callback' => static function ( $value, $allData ) {
		echo $allData['foo'];
		return $allData['bar'];
	}
];

$safeValidationCallback = [
	'type' => 'text',
	'validation-callback' => static function ( $value, $allData ) {
		return htmlspecialchars( $value ) . htmlspecialchars( $allData['x'] );
	}
];

$unsafeCallback = static function ( $value ) {
	echo $value;
	return $value;
};

$indirectUnsafeValidationCallback = [
	'type' => 'text',
	'validation-callback' => $unsafeCallback,
];