Page MenuHomePhabricator
Create Task
Maniphest T414592

ContributionsRangeTrait fails to parse CIDR using "X.X.X.X - Y.Y.Y.Y" format
Closed, ResolvedPublicBUG REPORT
Actions

Description

Summary

The ContributionsRangeTrait fails to parse a CIDR if it is in the format of X.X.X.X - Y.Y.Y.Y

Steps to replicate the issue

  1. Open https://en.wikipedia.org/w/index.php?oldid=323185528&title=Wikipedia:Abuse_reports/79.0.0.0_-_79.63.255.255 (or similar page where the page target is considered an IP range using the format X.X.X.X - Y.Y.Y.Y)

What happens?:
A logstash log appears with a PHP warning of Undefined array key 1

What should have happened instead?:
No logstash log should have been created

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Fix parsing of dash-separated IP ranges in contributionsAarohisharma3mediawiki/coremaster+103 -21
Consider IP range with dash as invalid in ContributionsRangeTraitDreamy Jazzmediawiki/coremaster+10 -1
Customize query in gerrit

Related Objects

Event Timeline

Dreamy_Jazz created this task.Jan 14 2026, 3:21 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 14 2026, 3:21 PM
Dreamy_Jazz updated the task description. (Show Details)Jan 14 2026, 3:21 PM
gerritbot added a comment.Jan 14 2026, 3:43 PM

Change #1226877 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/core@master] Consider IP range with dash as invalid in ContributionsRangeTrait

https://gerrit.wikimedia.org/r/1226877

gerritbot added a project: Patch-For-Review.Jan 14 2026, 3:43 PM
Dreamy_Jazz claimed this task.Jan 14 2026, 3:43 PM
Dreamy_Jazz moved this task from Backlog to Needs review on the Product Safety and Integrity (Essential Work Sprint (Dec 15th - Jan 9th)) board.
gerritbot added a comment.Jan 14 2026, 4:19 PM

Change #1226894 had a related patch set uploaded (by Aarohisharma3; author: Aarohisharma3):

[mediawiki/core@master] Fix parsing of dash-separated IP ranges in contributions

https://gerrit.wikimedia.org/r/1226894

Aarohisharma3 subscribed.Jan 14 2026, 4:23 PM

I've submitted the patch : https://phabricator.wikimedia.org/T414592

Changes:

  • ContributionsRangeTrait: Added detection for dash-separated ranges before CIDR parsing, with safe splitting, whitespace trimming, and validation of both IP addresses
  • HTMLUserTextField: Added dash-separated range handling and count validation before array destructuring to prevent undefined index warnings
  • Both files now validate array count before accessing elements

The fix ensures that:

  • Dash-separated IP ranges are properly detected and handled
  • CIDR notation continues to work as expected
  • No undefined array key warnings are generated
  • Both IPv4 and IPv6 ranges are supported
Dreamy_Jazz added a comment.Jan 14 2026, 4:25 PM
In T414592#11522068, @Aarohisharma3 wrote:

I've submitted the patch : https://phabricator.wikimedia.org/T414592

Changes:

  • ContributionsRangeTrait: Added detection for dash-separated ranges before CIDR parsing, with safe splitting, whitespace trimming, and validation of both IP addresses
  • HTMLUserTextField: Added dash-separated range handling and count validation before array destructuring to prevent undefined index warnings
  • Both files now validate array count before accessing elements

The fix ensures that:

  • Dash-separated IP ranges are properly detected and handled
  • CIDR notation continues to work as expected
  • No undefined array key warnings are generated
  • Both IPv4 and IPv6 ranges are supported

Hi. I already have a patch I made for this task that I've discussed. I don't think we need changes to HTMLUserTextField as this does not currently affect Special:Contributions pages

Aarohisharma3 added a comment.Jan 14 2026, 4:31 PM

Okay sure, makes sense
Thanks for the clarification!

gerritbot added a comment.Jan 19 2026, 4:01 PM

Change #1226877 merged by jenkins-bot:

[mediawiki/core@master] Consider IP range with dash as invalid in ContributionsRangeTrait

https://gerrit.wikimedia.org/r/1226877

Dreamy_Jazz closed this task as Resolved.EditedJan 20 2026, 9:48 AM
Dreamy_Jazz moved this task from Needs review to Done on the Product Safety and Integrity (Essential Work Sprint (Dec 15th - Jan 9th)) board.

The original bug described in this ticket is fixed on testwiki. A wider change in the other patch by Aarohisharma3 is probably best handled in a different ticket where the wider implications of modifying HTMLUserTextField can be considered

cc @Aarohisharma3 to create a new ticket if you still want to work on your patch

Aarohisharma3 added a comment.Jan 20 2026, 1:23 PM

Thanks for closing this! Confirmed that the original issue is resolved.

I’ll create a new task to discuss the wider behaviour changes around handling dash-separated IP ranges in HTMLUserTextField and Contributions parsing, as suggested.

gerritbot added a comment.Jan 20 2026, 1:30 PM

Change #1226894 abandoned by Aarohisharma3:

[mediawiki/core@master] Fix parsing of dash-separated IP ranges in contributions

https://gerrit.wikimedia.org/r/1226894

Maintenance_bot removed a project: Patch-For-Review.Jan 20 2026, 1:32 PM
Aarohisharma3 mentioned this in T415066: Support for dash-separated IP ranges in MediaWiki input components.Jan 20 2026, 1:37 PM
Aklapper added a project: MediaWiki-General.Jan 20 2026, 2:16 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits