Suggested patch:

Adding @Yaron_Koren to the task who seemingly is the only active maintainer of the extension.

@SomeRandomDeveloper - yes, I'm the closest thing this extension has to a maintainer. This looks like a great improvement! If you want correct attribution, etc. for this patch, feel free to create a Gerrit patch for it, and I will check it in; otherwise I will create it myself. Either way is fine with me.

Change #1193565 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WatchAnalytics@master] SECURITY: Escape user input in SQL queries

https://gerrit.wikimedia.org/r/1193565

Change #1193566 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WatchAnalytics@REL1_44] SECURITY: Escape user input in SQL queries

https://gerrit.wikimedia.org/r/1193566

Change #1193567 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WatchAnalytics@REL1_43] SECURITY: Escape user input in SQL queries

https://gerrit.wikimedia.org/r/1193567

(No backport for REL1_39 as that branch doesn't exist for this extension)

Change #1193567 merged by jenkins-bot:

[mediawiki/extensions/WatchAnalytics@REL1_43] SECURITY: Escape user input in SQL queries

https://gerrit.wikimedia.org/r/1193567

Change #1193566 merged by jenkins-bot:

[mediawiki/extensions/WatchAnalytics@REL1_44] SECURITY: Escape user input in SQL queries

https://gerrit.wikimedia.org/r/1193566

@SomeRandomDeveloper - thank you for these patches. The one for master is not going through because of the recent removal of the cl_to field from the categorylinks table - which presumably is also preventing commits in something like 50 other extensions that use cl_to (including some of my own). I need to modify my extensions to not query cl_to - although if you want to try your hand at fixing WatchAnalytics, feel free. (The use of cl_to in WatchAnalytics seems more involved than in most of the others.)

In T406380#11244232, @Yaron_Koren wrote:

@SomeRandomDeveloper - thank you for these patches. The one for master is not going through because of the recent removal of the cl_to field from the categorylinks table - which presumably is also preventing commits in something like 50 other extensions that use cl_to (including some of my own). I need to modify my extensions to not query cl_to - although if you want to try your hand at fixing WatchAnalytics, feel free. (The use of cl_to in WatchAnalytics seems more involved than in most of the others.)

I'm currently looking into this and I've already fixed it in one place in WatchAnalytics, so assuming I can fix the others as well, I'll upload a patch soon

I fixed SpecialClearPendingReviews with

diff --git a/specials/SpecialClearPendingReviews.php b/specials/SpecialClearPendingReviews.php
index 60ee10f..4ab1ec4 100644
--- a/specials/SpecialClearPendingReviews.php
+++ b/specials/SpecialClearPendingReviews.php
@@ -115,13 +115,13 @@ class SpecialClearPendingReviews extends SpecialPage {
 
                if ( $category ) {
                        $quotedCategory = $dbw->addQuotes( $category );
-                       $conditions .= "c.cl_to=$quotedCategory AND ";
+                       $conditions .= "l.lt_title=$quotedCategory AND ";
                }
                if ( $page ) {
                        $conditions .= 'w.wl_title ' . $dbw->buildLike( $page, $dbw->anyString() ) . ' AND ';
                }
 
-               $tables = [ 'w' => 'watchlist', 'p' => 'page', 'c' => 'categorylinks' ];
+               $tables = [ 'w' => 'watchlist', 'p' => 'page', 'c' => 'categorylinks', 'l' => 'linktarget' ];
                $vars = [ 'w.*' ];
                $conditions .= "w.wl_notificationtimestamp IS NOT NULL AND w.wl_notificationtimestamp < $end AND w.wl_notificationtimestamp > $start";
                $join_conds = [
@@ -130,6 +130,9 @@ class SpecialClearPendingReviews extends SpecialPage {
                        ],
                        'c' => [
                                'LEFT JOIN', 'c.cl_from=p.page_id'
+                       ],
+                       'l' => [
+                               'LEFT JOIN', 'l.lt_id=c.cl_target_id'
                        ]
                ];

(feel free to take that diff, attribution doesn't really matter to me here)
but since I'm not familiar with the rest of the extension, I actually can't properly test it, so @Yaron_Koren if you could fix the other ones, that'd be great

@Yaron_Koren could you please fix CI for the extension or just force merge the patch? I would prefer not having unmerged SQLI patches on gerrit for multiple days, especially since most of your extensions use the master branch instead of release branches, so wiki admins installing this extension might clone the unfixed version

Change #1193565 merged by Paladox:

[mediawiki/extensions/WatchAnalytics@master] SECURITY: Escape user input in SQL queries

https://gerrit.wikimedia.org/r/1193565