DataSourceTokenizer.php:574)
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	A_smart_kitten
	Jan 7 2026, 9:59 AM

Description

mediawiki/core locally running PHP 8.5
composer phpunit:entrypoint -- --filter UploadVerificationTest::testCheckSvgScriptCallback#70

1) UploadVerificationTest::testCheckSvgScriptCallback with data set #70 ('<svg xmlns="http://www.w3.org...</svg>', true, true, 'escaping comment full-width (T85085)')
ord(): Providing a string that is not one byte long is deprecated. Use ord($str[0]) instead

/[...]/mediawiki/core/vendor/wikimedia/css-sanitizer/src/Parser/DataSourceTokenizer.php:574
/[...]/mediawiki/core/vendor/wikimedia/css-sanitizer/src/Parser/DataSourceTokenizer.php:336
/[...]/mediawiki/core/vendor/wikimedia/css-sanitizer/src/Parser/Parser.php:116
/[...]/mediawiki/core/vendor/wikimedia/css-sanitizer/src/Parser/Parser.php:253
/[...]/mediawiki/core/includes/Upload/SVGCSSChecker.php:51
/[...]/mediawiki/core/includes/Upload/UploadVerification.php:820
/[...]/mediawiki/core/vendor/wikimedia/testing-access-wrapper/src/TestingAccessWrapper.php:100
/[...]/mediawiki/core/includes/libs/Mime/XmlTypeCheck.php:334
/[...]/mediawiki/core/includes/libs/Mime/XmlTypeCheck.php:234
/[...]/mediawiki/core/includes/libs/Mime/XmlTypeCheck.php:178
/[...]/mediawiki/core/includes/libs/Mime/XmlTypeCheck.php:109
/[...]/mediawiki/core/tests/phpunit/includes/Upload/UploadVerificationTest.php:966
/[...]/mediawiki/core/tests/phpunit/includes/Upload/UploadVerificationTest.php:76

(note: not yet seen in WMF experimental CI due to the order in which it runs MediaWiki's PHPUnit tests, but it presumably would be seen there at some point)

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Pass first byte to ord() in DataSourceTokenizer	css-sanitizer	master	+5 -5

Customize query in gerrit

Related Objects

Mentioned In: rCSSS245cb2d56a9f: Pass first byte to ord() in DataSourceTokenizer
T411814: Make PHP 8.5 voting on development (master) branch of MW ecosystem (core, vendor, extensions, skins, libraries) in CI
T413957: ord(): Providing an empty string is deprecated (from css-sanitizer/src/Parser/DataSourceTokenizer.php:589/621)

Event Timeline

A_smart_kitten created this task.Jan 7 2026, 9:59 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 7 2026, 9:59 AM

A_smart_kitten mentioned this in T413957: ord(): Providing an empty string is deprecated (from css-sanitizer/src/Parser/DataSourceTokenizer.php:589/621).Jan 7 2026, 10:03 AM

Reedy moved this task from Backlog to MediaWiki core on the PHP 8.5 support board.Jan 7 2026, 9:12 PM

A_smart_kitten mentioned this in T411814: Make PHP 8.5 voting on development (master) branch of MW ecosystem (core, vendor, extensions, skins, libraries) in CI.Jan 12 2026, 11:11 AM

Prashant32194 subscribed.Jan 14 2026, 6:54 PM

A full-width slash ／ is used in that test and passed to ord(), which expect only single-bytes characters.

css sanitizer expect valid utf-8, but seems not working well with multibyte character

Umherirrender claimed this task.Fri, Jan 16, 10:48 PM

Change #1227934 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[css-sanitizer@master] Pass first byte to ord() in DataSourceTokenizer

https://gerrit.wikimedia.org/r/1227934

gerritbot added a project: Patch-For-Review.Fri, Jan 16, 10:48 PM

In T413956#11530690, @Umherirrender wrote:

A full-width slash ／ is used in that test and passed to ord(), which expect only single-bytes characters.

css sanitizer expect valid utf-8, but seems not working well with multibyte character

It seems I was wrong, according to code comments the function can be used with multibyte utf8 character and the code expect that ord() only works with the first given byte as it checks ascii only, but that now changed in php and is fixed with the given patch set.

Change #1227934 merged by jenkins-bot:

[css-sanitizer@master] Pass first byte to ord() in DataSourceTokenizer

https://gerrit.wikimedia.org/r/1227934

Umherirrender mentioned this in rCSSS245cb2d56a9f: Pass first byte to ord() in DataSourceTokenizer.Thu, Feb 12, 10:24 AM

Maintenance_bot removed a project: Patch-For-Review.Thu, Feb 12, 10:31 AM

Umherirrender closed this task as Resolved.Thu, Feb 12, 6:37 PM