To solve this we probably need to filter out all private tags from the initialTags list because we don't have filtering on the log_params field to remove these private tags from database dumps and from log API outputs (and doing that will likely be an expensive LIKE query)

Excluding the private tags has the downside that it's not included in the log even for users who can see it. However:

• The initialTags param is not used in the message and so only visible within the API view of the log entries
• https://codesearch.wmcloud.org/search/?q=initialTags&files=&excludeFiles=&repos= only shows one use of the initialTags property and is not for WMF wikis (and even then only just copies the value to a new log entry when migrating logs)

Longer term I wonder if there is a need for initialTags in the the log entry parameters? However, removing that seems like too much of a wide scope for a security fix

Queries on production appear to show that no-one has yet triggered this on English Wikipedia (and so the fix can be made just in PHP without needing for us to deal with existing leaks of data)

(enwiki)> SELECT * FROM logging where log_type = 'tag' AND log_action = 'update' AND log_params LIKE '%initialTags%private%' LIMIT 1;
Empty set (0.003 sec)

Proposed patch:

Verified that it stops new tag/update log entries from recording private tag names. +2

Deployed:

• https://sal.toolforge.org/log/uDl7gaABDAZZyZXnzNPv
• https://sal.toolforge.org/log/ljmEgaABDAZZyZXnCerX

SELECT * FROM logging where log_type = 'tag' AND log_action = 'update' AND log_params LIKE '%initialTags%private%' LIMIT 1; still returns no rows on enwiki, so no logging rows need handling retroactively

The private tag feature only exists in MediaWiki 1.47 which has not been released yet. Therefore, this patch can be made public now and so I'm going to upload the patch to the master branch.

Patch uploaded: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1337950

This task can be made public now

Adding Security-Team to do the visibility change for the task

The feature does not exist in any release version, so no need to put this under T429198: Tracking bug for MediaWiki 1.43.10/1.45.5/1.46.1 (as there will be no security backports to release versions needed and so no need to announce the fix for it)

I cannot reproduce the bug in the description. I tagged all my local revisions and logs with private tags, then I added/removed other tags to them. The private tags did not appear in list=logevents.

I have also tried to find similar leaks in other APIs, but I have not found any yet.