Wikimedia production MediaWiki extensions should use mediawiki.storage rather than access localStorage/sessionStorage directly
Open, Needs TriagePublic
Actions

Description

Follow-up T401978 and the new lint rule we added in https://github.com/wikimedia/eslint-plugin-mediawiki/issues/119. There's a few WMF-deployed repos that currently violate this new lint rule and should be fixed (or explicitly annotated with rationale, if they handle their own exceptions and must bypass mw.storage for some reason).

Scope

mediawiki/extensions/CentralAuth (2 files)
- modules/ext.centralauth.centralautologin.js (1 matches)
- modules/inline/anon-set.js (1 matches)
mediawiki/extensions/CentralNotice (2 files)
- resources/ext.centralNotice.kvStore/kvStore.js (5 matches)
- resources/ext.centralNotice.startUp/kvStoreMaintenance.js (1 matches)
mediawiki/extensions/PageTriage (1 files)
- modules/ext.pageTriage.newPagesFeed/stores/settings.js (2 matches)
mediawiki/extensions/UniversalLanguageSelector (1 files)
- resources/js/ext.uls.common.js (2 matches)

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
Use mw.storage for previousLanguage storage	mediawiki/extensions/UniversalLanguageSelector	master	+6 -18
Use mw.storage instead of localStorage directly	mediawiki/extensions/PageTriage	master	+7 -7
build: Move mediawiki/no-storage disable inline and document reason	mediawiki/extensions/CentralAuth	master	+5 -4

Customize query in gerrit

Related Objects

Mentioned Here: T401978: TypeError: Cannot read properties of null (reading 'getItem')

Event Timeline

Jdforrester-WMF created this task.Nov 17 2025, 1:18 PM

Restricted Application added projects: MediaWiki-Platform-Team, Moderator-Tools-Team. · View Herald TranscriptNov 17 2025, 1:18 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Jdforrester-WMF removed a project: StructuredDiscussions.Nov 17 2025, 1:23 PM

Jdforrester-WMF updated the task description. (Show Details)

I've removed the VE hits as they were calling ve.init.platform.sessionStorage which is already a wrapper around mw.storage (at least in ve-mw).

Esanders removed a project: VisualEditor.Nov 17 2025, 2:56 PM

JTweed-WMF moved this task from Inbox, needs triage to Next (DO NOT USE) on the MediaWiki-Platform-Team board.Nov 17 2025, 3:45 PM

Krinkle updated the task description. (Show Details)Nov 17 2025, 3:48 PM

Krinkle updated the task description. (Show Details)

Added background to ease triage in our team. I've marked CentralAuth as completed without a patch, because it already handles exceptions locally, and bypasses the abstraction because it is a raw inline script (bypassing ResourceLoader and thus cannot easily depend on a module).

anon-set.js is inline. ext.centralauth.centralautologin.js could in theory use another module (although it only uses localStorage.getItem() which I think isn't supposed to throw exceptions).

In T410271#11379411, @Krinkle wrote:

Added background to ease triage in our team. I've marked CentralAuth as completed without a patch, because it already handles exceptions locally, and bypasses the abstraction because it is a raw inline script (bypassing ResourceLoader and thus cannot easily depend on a module).

Per your own edit, there should be a patch that inlines the disables and they should be "explicitly annotated with rationale[s]".

Change #1206426 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/extensions/CentralAuth@master] build: Move mediawiki/no-storage disable inline and document reason

https://gerrit.wikimedia.org/r/1206426

gerritbot added a project: Patch-For-Review.Nov 17 2025, 5:33 PM

In T410271#11379654, @Tgr wrote:

anon-set.js is inline. ext.centralauth.centralautologin.js could in theory use another module (although it only uses localStorage.getItem() which I think isn't supposed to throw exceptions).

localStorage.getItem() can throw as well, usually by way of the global localStorage getter (window.localStorage) throwing rather than the individual method. This is the same way that the document.cookie getter cant throw in certain privacy modes.

Change #1206426 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] build: Move mediawiki/no-storage disable inline and document reason

https://gerrit.wikimedia.org/r/1206426

Samwalton9-WMF moved this task from Inbox to Triaged on the Moderator-Tools-Team board.Nov 19 2025, 11:18 AM

Maintenance_bot removed a project: Patch-For-Review.Nov 19 2025, 11:30 AM

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.4; 2025-11-25).Nov 19 2025, 12:00 PM

Krinkle unsubscribed.Nov 19 2025, 1:12 PM

Change #1219539 had a related patch set uploaded (by Esanders; author: Esanders):

[mediawiki/extensions/UniversalLanguageSelector@master] Use mw.storage for previousLanguage storage

https://gerrit.wikimedia.org/r/1219539

gerritbot added a project: Patch-For-Review.Dec 18 2025, 10:03 AM

Change #1219592 had a related patch set uploaded (by Esanders; author: Esanders):

[mediawiki/extensions/PageTriage@master] Use mw.storage instead of localStorage directly

https://gerrit.wikimedia.org/r/1219592

Change #1219592 merged by jenkins-bot: