Please do a security review of Wikibase-Quality-Constraints
Thank you very much!
Gerrit:
= Project =
**Repo:** https://gerrit.wikimedia.org/r/#/admin/projects/mediawiki/extensions/WikidataQualityConstraints
**Evaluated:** f655fc3ea04d4c8b37f5a61a6b74ce258b024bb0
**Dependencies:**
* wikibase/wikibase, wikibase/data-model, wikibase/quality
* composer/installers
= Review =
**Did we work with the team during the design phase?** No
**Data-flow diagram:**
== Architecture issues
* (T101303) The update process is a manual ETL, and has to be run by a deployer for each data update. It's not clear why the database and tools need to live on the cluster.
== Hardening
* (T101305) Escape SQL input in the functions that interact with the DB
* SpecialConstraintReport should use an HTMLForm, which will add csrf protection
* (T101306) Use escaped() instead of text() when inserting messages into raw html
* (T101308) Escape $entityId->getSerialization()
* Document which function parameters are expected to be sanitized HTML, and when functions return HTML. If the safety of the returned HTML relies on an input parameter being properly sanitized, document that assumption.
== Vulnerabilities
*