Page MenuHomePhabricator
Create Task
Maniphest T94900

Potentially unsafe "href" attribute value
Closed, ResolvedPublic1 Estimated Story PointsPRODUCTION ERROR
Actions

Description

Spotted in production:

  14 Fatal error: exception 'OOUI\Exception' with message 'Potentially unsafe 'href' attribute value' in /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php:316
   Stack trace:
#0 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(358): OOUI\Tag->toString()
#1 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(336): OOUI\Tag->__toString()
#2 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Element.php(274): OOUI\Tag->toString()
#3 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(358): OOUI\Element->toString()
#4 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(336): OOUI\Tag->__toString()
#5 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Element.php(274): OOUI\Tag->toString()
#6 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(358): OOUI\Element->toString()
#7 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(336): OOUI\Tag->__toString()
#8 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Element.php(274): OOUI\Tag->toString()
#9 /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php(358): OOUI\Element->toString()
#10 /srv/mediawiki/php-1.25wmf23/includes/OutputPage.php(1515): OOUI\Tag->__toString()
#11 /srv/mediawiki/php-1.25wmf23/extensions/Collection/Collection.body.php(387): OutputPage->addHTML()
#12 /srv/mediawiki/php-1.25wmf23/extensions/Collection/Collection.body.php(71): SpecialCollection->renderBookCreatorPage()
#13 /srv/mediawiki/php-1.25wmf23/includes/specialpage/SpecialPage.php(384): SpecialCollection->execute()
#14 /srv/mediawiki/php-1.25wmf23/includes/specialpage/SpecialPageFactory.php(581): SpecialPage->run()
#15 /srv/mediawiki/php-1.25wmf23/includes/MediaWiki.php(268): SpecialPageFactory::executePath()
#16 /srv/mediawiki/php-1.25wmf23/includes/MediaWiki.php(571): MediaWiki->performRequest()
#17 /srv/mediawiki/php-1.25wmf23/includes/MediaWiki.php(422): MediaWiki->main()
#18 /srv/mediawiki/php-1.25wmf23/index.php(46): MediaWiki->run()
#19 /srv/mediawiki/w/index.php(3): include()
#20 {main} in /srv/mediawiki/php-1.25wmf23/vendor/oojs/oojs-ui/php/Tag.php on line 360

Details

SubjectRepoBranchLines +/-
Avoid 'Potentially unsafe "href" attribute value' exceptions for relative URLsoojs/uimaster+51 -13
More useful debugging information on unsafe tag attributesoojs/uimaster+2 -1
Customize query in gerrit

Related Objects
Search...

Event Timeline

• demon created this task.Apr 2 2015, 8:49 PM
• demon raised the priority of this task from to Medium.
• demon updated the task description. (Show Details)
• demon added projects: Wikimedia-production-error, OOUI, Collection.
• demon subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 2 2015, 8:49 PM
Krenair subscribed.Apr 3 2015, 12:12 AM

See P468 comments

gerritbot subscribed.Apr 13 2015, 9:52 PM

Change 203968 had a related patch set uploaded (by Chad):
More useful debugging information on unsafe tag attributes

https://gerrit.wikimedia.org/r/203968

gerritbot added a project: Patch-For-Review.Apr 13 2015, 9:52 PM
gerritbot added a comment.Apr 14 2015, 2:29 PM

Change 203968 merged by jenkins-bot:
More useful debugging information on unsafe tag attributes

https://gerrit.wikimedia.org/r/203968

• demon mentioned this in rGOJU951be963e735: More useful debugging information on unsafe tag attributes.Apr 14 2015, 2:29 PM
Jdforrester-WMF closed this task as Resolved.May 4 2015, 6:06 PM
Jdforrester-WMF moved this task from Backlog to Doing on the OOUI board.
Jdforrester-WMF moved this task from Doing to Reviewing on the OOUI board.
Jdforrester-WMF set Security to None.
• demon reopened this task as Open.May 4 2015, 6:09 PM

This isn't resolved.

• demon removed a project: Patch-For-Review.May 4 2015, 6:17 PM

Just an update since there was some confusion here and on IRC: the bug isn't fixed yet. The debugging commits attached above should be going out with 1.26wmf4 and we'll be able to find a little more info for fixing the root bug.

matmarex subscribed.May 12 2015, 2:37 PM

So, did we discover what is causing this?

• demon added a comment.May 12 2015, 7:46 PM

That's a much better error:

'Potentially unsafe 'href' attribute value. Scheme: ''; value: '/wiki/%D9%85%D9%84%D8%AD%D9%82:1930'.'
matmarex added a comment.May 12 2015, 8:01 PM

Hmm… so apparently parse_url considers that a "seriously malformed URL" and thus returns false (which turns into an empty string in the error message). We should probably explicitly check for and allow relative URLs, rather than rely on parse_url to recognize them.

matmarex raised the priority of this task from Medium to High.May 13 2015, 8:36 AM
hashar added a parent task: T99210: Cannot modify header information - headers already sent in /srv/mediawiki/hhvm-fatal-error.php on line 814.Jun 1 2015, 12:29 PM
hashar moved this task from Untriaged to Jan 2019 / 1.33.wmf13–14 on the Wikimedia-production-error board.
hashar moved this task from Reviewing to Next-up on the OOUI board.Jun 1 2015, 12:31 PM
hashar added subscribers: Jdforrester-WMF, hashar.

@Jdforrester-WMF this has been reopened. Chad simply enhanced the log message to be more useful.

matmarex claimed this task.Jun 1 2015, 1:13 PM

Meh, I guess I'm the primary maintainer now.

gerritbot added a comment.Jun 1 2015, 4:13 PM

Change 215052 had a related patch set uploaded (by Bartosz Dziewoński):
Avoid 'Potentially unsafe "href" attribute value' exceptions for relative URLs

https://gerrit.wikimedia.org/r/215052

gerritbot added a project: Patch-For-Review.Jun 1 2015, 4:13 PM
gerritbot added a comment.Jun 1 2015, 6:46 PM

Change 215052 merged by jenkins-bot:
Avoid 'Potentially unsafe "href" attribute value' exceptions for relative URLs

https://gerrit.wikimedia.org/r/215052

matmarex mentioned this in rGOJU9ff89da79131: Avoid 'Potentially unsafe "href" attribute value' exceptions for relative URLs.Jun 1 2015, 6:46 PM
Jdforrester-WMF closed this task as Resolved.Jun 1 2015, 6:50 PM
Jdforrester-WMF edited projects, added VisualEditor 2014/15 Q4 blockers, OOjs-UI-next-release; removed Patch-For-Review.
hashar moved this task from Jan 2019 / 1.33.wmf13–14 to Mar 2019 / 1.33wmf20-23 on the Wikimedia-production-error board.Jun 1 2015, 6:50 PM
Jdforrester-WMF edited a custom field.Jun 1 2015, 6:50 PM
hashar reopened this task as Open.Jun 1 2015, 6:51 PM

Reopening till this is applied to production and effectively get rid of the error messages we see.

Jdforrester-WMF added a comment.Jun 1 2015, 6:53 PM
In T94900#1326750, @hashar wrote:

Reopening till this is applied to production and effectively get rid of the error messages we see.

That's what the child bug is for.

Jdforrester-WMF closed this task as Resolved.Jun 1 2015, 8:32 PM
Jdforrester-WMF moved this task from Nominated to Done on the VisualEditor 2014/15 Q4 blockers board.Jun 1 2015, 8:39 PM
hashar mentioned this in T99210: Cannot modify header information - headers already sent in /srv/mediawiki/hhvm-fatal-error.php on line 814.Jun 2 2015, 1:21 PM
Jdforrester-WMF moved this task from Next-up to Reviewing on the OOUI board.Jun 3 2015, 9:12 PM
hashar added a comment.Jun 5 2015, 9:43 AM

I can confirm the message is gone from the logs.

hashar moved this task from Mar 2019 / 1.33wmf20-23 to Resolved on the Wikimedia-production-error board.Jun 5 2015, 9:44 AM
Jdforrester-WMF edited projects, added OOUI (OOjs-UI-0.11.4), WMF-deploy-2015-06-16_(1.26wmf10); removed OOjs-UI-next-release.Jun 9 2015, 10:26 PM
• mmodell changed the subtype of this task from "Task" to "Production Error".Aug 28 2019, 11:11 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits