As the first step to getting phan-taint-check running on MW core, we need to get rid of the false (and true!) positives in MW core.
As first step, ignore the double escaping warnings, to make this task more manageable (We can exclude those warnings in initial deployment to build process)
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Daimona | T203630 Configure CI to run phan-taint-check-plugin for MediaWiki core | |||
| Resolved | Umherirrender | T231311 Enable seccheck for MW core | |||
| Resolved | None | T216348 Suppress or fix non-double escape phan-taint-check warnings for MW core | |||
| Resolved | Daimona | T268891 taint-check fails on array-plus and assumed int|float type | |||
| Resolved | Daimona | T268905 taint-check has trouble for taintedness of unknown array keys and reports possible false positives | |||
| Resolved | Umherirrender | T268920 taint-check 3.1.0 showing more issues from type SecurityCheck-OTHER |
I checked with 2.x, and we have 64 DoubleEscaped of a total of 512 warnings, so they're not really a problem. I'll sample a few warnings and check how many false positives I got. If there are too many, it may be worth fixing taint-check first (if the fix is easy), then start working on core as soon as a future version (not 2.0) is released.
EDIT: And apparently some of them are false positives. I'll check how we can fix those. ATM I cannot compare the results with seccheck master due to system incompatibility, so I'm wondering, is there an error count available for taint-check master?
After having fixed some other regressions, running https://gerrit.wikimedia.org/r/#/c/mediawiki/tools/phan/SecurityCheckPlugin/ /507619/ on core yields 218 DoubleEscaped warnings and 249 total warnings. I'll look into the remaining issues.
@sbassett Great question! I think we need the final error count with seccheck 2.x. Individual tasks will probably be the right choice once we get a limited amount of different errors.
Change 522419 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/core@master] [WIP] Add phan-taint-check-plugin
Current warnings list is here:
It has 187 warnings, of which 165 are DoubleEscaped. This is way less than T216348#5185224.
Some of those are actual issues. However, I'd like to wait for seccheck 3.0 before starting to fix them.
Latest result with taint-check 3.0.1 (excluding roughly 120 DoubleEscaped warnings):
<checkstyle version="6.5">
<file name="includes/OutputPage.php">
<error line="2559" severity="warning" message="Echoing expression that was not html escaped (Caused by: includes/OutputPage.php 1611; includes/OutputPage.php 1589; includes/OutputPage.php 1598; includes/OutputPage.php 1970; includes/OutputPage.php 2559; includes/OutputPage.php 2653; includes/OutputPage.php 3981; includes/OutputPage.php 2843; i...)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/Revision/RevisionStore.php">
<error line="2452" severity="error" message="Calling method \Wikimedia\Rdbms\DBConnRef::selectField() in \MediaWiki\Revision\RevisionStore::getRelativeRevision that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\DBConnRef::selectField)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="includes/export/WikiExporter.php">
<error line="529" severity="warning" message="Calling method \DumpOutput::writeOpenPage() in \WikiExporter::outputPageStreamBatch that outputs using tainted argument $output. (Caused by: includes/export/DumpOutput.php 50) (Caused by: includes/export/WikiExporter.php 528)" source="SecurityCheck-XSS"/>
<error line="532" severity="warning" message="Calling method \DumpOutput::writeRevision() in \WikiExporter::outputPageStreamBatch that outputs using tainted argument $output. (Caused by: includes/export/DumpOutput.php 65) (Caused by: includes/export/WikiExporter.php 531)" source="SecurityCheck-XSS"/>
<error line="596" severity="warning" message="Calling method \DumpOutput::writeLogItem() in \WikiExporter::outputLogStream that outputs using tainted argument $output. (Caused by: includes/export/DumpOutput.php 73) (Caused by: includes/export/WikiExporter.php 595)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/installer/CliInstaller.php">
<error line="233" severity="warning" message="Echoing expression that was not html escaped (Caused by: includes/installer/CliInstaller.php 253)" source="SecurityCheck-XSS"/>
<error line="238" severity="warning" message="Echoing expression that was not html escaped (Caused by: includes/installer/CliInstaller.php 253)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/installer/PostgresUpdater.php">
<error line="1113" severity="error" message="Calling method \Wikimedia\Rdbms\DatabasePostgres::query() in \PostgresUpdater::dropFkey that outputs using tainted argument $command. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/installer/PostgresUpdater.php 1112; includes/installer/PostgresUpdater.php 1108)" source="SecurityCheck-SQLInjection"/>
<error line="1135" severity="error" message="Calling method \Wikimedia\Rdbms\DatabasePostgres::query() in \PostgresUpdater::changeFkeyDeferrable that outputs using tainted argument $command. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/installer/PostgresUpdater.php 1134; includes/installer/PostgresUpdater.php 1131)" source="SecurityCheck-SQLInjection"/>
<error line="1144" severity="error" message="Calling method \Wikimedia\Rdbms\DatabasePostgres::query() in \PostgresUpdater::changeFkeyDeferrable that outputs using tainted argument $command. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/installer/PostgresUpdater.php 1134; includes/installer/PostgresUpdater.php 1131; includes/installer/PostgresUpdater.php 1141; includes/installer/PostgresUpdater.php 1133; includes/installer/PostgresUpdater.php 1131)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="includes/installer/WebInstallerOptions.php">
<error line="217" severity="warning" message="Calling method \Message::rawParams() in \WebInstallerOptions::execute that outputs using tainted argument $ext. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175) (Param is raw)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/jobqueue/utils/BacklinkJobUtils.php">
<error line="102" severity="error" message="Calling method \BacklinkCache::partition() in \BacklinkJobUtils::partitionBacklinkJob that outputs using tainted argument $[arg #1]. (Caused by: includes/cache/BacklinkCache.php 441) (Caused by: includes/jobqueue/utils/BacklinkJobUtils.php 90)" source="SecurityCheck-SQLInjection"/>
<error line="112" severity="error" message="Calling method \BacklinkCache::getLinks() in \BacklinkJobUtils::partitionBacklinkJob that outputs using tainted argument $[arg #1]. (Caused by: includes/cache/BacklinkCache.php 172) (Caused by: includes/jobqueue/utils/BacklinkJobUtils.php 90)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="includes/libs/rdbms/database/DatabasePostgres.php">
<error line="835" severity="error" message="Calling method \Wikimedia\Rdbms\DatabasePostgres::query() in \Wikimedia\Rdbms\DatabasePostgres::resetSequencesForTable that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/libs/rdbms/database/DatabasePostgres.php 831)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="includes/libs/rdbms/database/DatabaseSqlite.php">
<error line="1026" severity="error" message="Calling method \Wikimedia\Rdbms\DatabaseSqlite::query() in \Wikimedia\Rdbms\DatabaseSqlite::duplicateTableStructure that outputs using tainted argument $sql. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/libs/rdbms/database/DatabaseSqlite.php 1009; includes/libs/rdbms/database/DatabaseSqlite.php 1022)" source="SecurityCheck-SQLInjection"/>
<error line="1052" severity="error" message="Calling method \Wikimedia\Rdbms\DatabaseSqlite::query() in \Wikimedia\Rdbms\DatabaseSqlite::duplicateTableStructure that outputs using tainted argument $sql. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/libs/rdbms/database/DatabaseSqlite.php 1042; includes/libs/rdbms/database/DatabaseSqlite.php 1041; includes/Storage/NameTableStore.php 384; includes/libs/rdbms/database/DatabaseSqlite.php 607; includes/libs/rdbms/database/DatabaseSqlite...)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="includes/logging/LogFormatter.php">
<error line="255" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="260" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="273" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="277" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="304" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="310" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="314" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="320" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="335" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="348" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="353" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="372" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="376" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="383" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="406" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $duration. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 400) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="406" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="410" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="421" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $duration. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 414) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="421" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="430" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="434" severity="warning" message="Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/logging/LogPage.php">
<error line="250" severity="warning" message="Calling method \Message::rawParams() in \LogPage::actionText that outputs using tainted argument $titleLink. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogPage.php 247) (Param is raw)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/page/ImagePage.php">
<error line="165" severity="warning" message="Calling method \OutputPage::addHTML() in \ImagePage::view that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/page/ImagePage.php 733; includes/page/ImagePage.php 709)" source="SecurityCheck-XSS"/>
<error line="510" severity="warning" message="Calling method \Message::rawParams() in \ImagePage::openShowImage that outputs using tainted argument $select. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/page/ImagePage.php 502) (Param is raw)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/parser/Parser.php">
<error line="3511" severity="warning" message="Calling method \Parser::insertStripItem() in \Parser::braceSubstitution that outputs using tainted argument $text. (Caused by: includes/parser/Parser.php 1230)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/preferences/DefaultPreferencesFactory.php">
<error line="379" severity="warning" message="Calling method \Message::rawParams() in \MediaWiki\Preferences\DefaultPreferencesFactory::profilePreferences that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/preferences/DefaultPreferencesFactory.php 364; includes/preferences/DefaultPreferencesFactory.php 350; includes/preferences/DefaultPreferencesFactory.php 372) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="379" severity="warning" message="Calling method \Message::rawParams() in \MediaWiki\Preferences\DefaultPreferencesFactory::profilePreferences that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/preferences/DefaultPreferencesFactory.php 365; includes/preferences/DefaultPreferencesFactory.php 351; includes/preferences/DefaultPreferencesFactory.php 373) (Param is raw)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/resourceloader/ResourceLoader.php">
<error line="917" severity="warning" message="Echoing expression that was not html escaped (Caused by: includes/resourceloader/ResourceLoader.php 870; includes/resourceloader/ResourceLoader.php 902)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/specials/SpecialContributions.php">
<error line="579" severity="warning" message="HTMLForm option label needs escaping (for value 'associated') (Caused by: Builtin-\Message::text; includes/language/Message.php 952)" source="SecurityCheck-XSS"/>
<error line="579" severity="warning" message="HTMLForm option label needs escaping (for value 'nsInvert') (Caused by: Builtin-\Message::text; includes/language/Message.php 952)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/specials/SpecialUserrights.php">
<error line="677" severity="warning" message="Calling method \Message::rawParams() in \UserrightsPage::showEditUserGroupsForm that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/specials/SpecialUserrights.php 654; includes/specials/SpecialUserrights.php 650; includes/specials/SpecialUserrights.php 657; includes/specials/SpecialUserrights.php 650) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="677" severity="warning" message="Calling method \Message::rawParams() in \UserrightsPage::showEditUserGroupsForm that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/specials/SpecialUserrights.php 655; includes/specials/SpecialUserrights.php 651; includes/specials/SpecialUserrights.php 658; includes/specials/SpecialUserrights.php 651) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="682" severity="warning" message="Calling method \Message::rawParams() in \UserrightsPage::showEditUserGroupsForm that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/specials/SpecialUserrights.php 670) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="682" severity="warning" message="Calling method \Message::rawParams() in \UserrightsPage::showEditUserGroupsForm that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/specials/SpecialUserrights.php 671) (Param is raw)" source="SecurityCheck-XSS"/>
<error line="757" severity="warning" message="Calling method \OutputPage::addHTML() in \UserrightsPage::showEditUserGroupsForm that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/specials/SpecialUserrights.php 691; includes/specials/SpecialUserrights.php 695; includes/specials/SpecialUserrights.php 677; includes/specials/SpecialUserrights.php 704; includes/specials/SpecialUserrights.php 700; includes/specials/S... includes/specials/SpecialUserrights.php 724)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/specials/SpecialVersion.php">
<error line="153" severity="warning" message="Calling method \OutputPage::addHTML() in \SpecialVersion::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/specials/SpecialVersion.php 495; includes/specials/SpecialVersion.php 483; includes/specials/SpecialVersion.php 491; includes/specials/SpecialVersion.php 493; includes/specials/SpecialVersion.php 469; includes/specials/SpecialVersion.php 436; includes/specials/SpecialVersion.php 460; includes/specials/SpecialVersion.php 465; includes/specials/SpecialVersion.php 467; includes/specials/SpecialVersion.php 600; includes/specials/SpecialVersion.php 642; includes/specials/SpecialVersion.php 671)" source="SecurityCheck-XSS"/>
</file>
<file name="includes/specials/forms/UploadForm.php">
<error line="139" severity="warning" message="HTMLForm info field in raw mode needs to escape default key (Caused by: includes/specials/SpecialUpload.php 263)" source="SecurityCheck-XSS"/>
<error line="306" severity="warning" message="HTMLForm info field in raw mode needs to escape default key (Caused by: includes/specials/SpecialUpload.php 263)" source="SecurityCheck-XSS"/>
</file>
<file name="maintenance/convertExtensionToRegistration.php">
<error line="87" severity="warning" message="Argument to require, include or eval is user controlled (Caused by: maintenance/convertExtensionToRegistration.php 83)" source="SecurityCheck-OTHER"/>
</file>
<file name="maintenance/convertLinks.php">
<error line="226" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \ConvertLinks::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/convertLinks.php 214; maintenance/convertLinks.php 210; maintenance/convertLinks.php 157; maintenance/convertLinks.php 206; maintenance/convertLinks.php 209; maintenance/convertLinks.php 162; includes/installer/MysqlUpdater.php 61...)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/fixTimestamps.php">
<error line="54" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \FixTimestamps::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/fixTimestamps.php 48; maintenance/fixTimestamps.php 47)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/generateJsonI18n.php">
<error line="71" severity="warning" message="Calling method \GenerateJsonI18n::transformI18nFile() in \GenerateJsonI18n::execute that outputs using tainted argument $phpfile. (Caused by: maintenance/generateJsonI18n.php 113) (Caused by: maintenance/generateJsonI18n.php 51; maintenance/generateJsonI18n.php 60; maintenance/generateJsonI18n.php 53)" source="SecurityCheck-OTHER"/>
<error line="91" severity="warning" message="Calling method \GenerateJsonI18n::transformI18nFile() in \GenerateJsonI18n::execute that outputs using tainted argument $phpfile. (Caused by: maintenance/generateJsonI18n.php 113) (Caused by: maintenance/generateJsonI18n.php 51; maintenance/generateJsonI18n.php 60; maintenance/generateJsonI18n.php 53)" source="SecurityCheck-OTHER"/>
</file>
<file name="maintenance/includes/MigrateActors.php">
<error line="316" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::update() in \MigrateActors::migrate that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::update) (Caused by: maintenance/includes/MigrateActors.php 306)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/mergeMessageFileList.php">
<error line="170" severity="warning" message="Argument to require, include or eval is user controlled (Caused by: maintenance/mergeMessageFileList.php 159)" source="SecurityCheck-OTHER"/>
</file>
<file name="maintenance/migrateComments.php">
<error line="105" severity="error" message="Calling method \Wikimedia\Rdbms\IDatabase::insert() in \MigrateComments::loadCommentIDs that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Wikimedia\Rdbms\IDatabase::insert) (Caused by: maintenance/migrateComments.php 73)" source="SecurityCheck-SQLInjection"/>
<error line="105" severity="error" message="Calling method \Wikimedia\Rdbms\IDatabase::insert() in \MigrateComments::loadCommentIDs that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Wikimedia\Rdbms\IDatabase::insert) (Caused by: maintenance/migrateComments.php 73; maintenance/migrateComments.php 169; maintenance/migrateComments.php 97; maintenance/migrateComments.php 263; maintenance/migrateComments.php 97; maintenance/migrateComments.php 265; maintenance/migrateComme...)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/nukeNS.php">
<error line="62" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \NukeNS::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/nukeNS.php 54)" source="SecurityCheck-SQLInjection"/>
<error line="72" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \NukeNS::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/nukeNS.php 69)" source="SecurityCheck-SQLInjection"/>
<error line="88" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \NukeNS::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/nukeNS.php 69)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/nukePage.php">
<error line="63" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \NukePage::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/nukePage.php 56)" source="SecurityCheck-SQLInjection"/>
<error line="74" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \NukePage::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/nukePage.php 56)" source="SecurityCheck-SQLInjection"/>
<error line="77" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \NukePage::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/nukePage.php 56)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/populateContentModel.php">
<error line="61" severity="error" message="Calling method \PopulateContentModel::populateRevisionOrArchive() in \PopulateContentModel::execute that outputs using tainted argument $table. (Caused by: maintenance/populateContentModel.php 229) (Caused by: maintenance/populateContentModel.php 57)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/populateContentTables.php">
<error line="217" severity="error" message="Calling method \Wikimedia\Rdbms\IDatabase::select() in \PopulateContentTables::populateTable that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IDatabase::select) (Caused by: maintenance/populateContentTables.php 216; maintenance/populateContentTables.php 215; maintenance/populateContentTables.php 199)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/recountCategories.php">
<error line="126" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::selectFieldValues() in \RecountCategories::doWork that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::selectFieldValues) (Caused by: maintenance/recountCategories.php 117; maintenance/recountCategories.php 82)" source="SecurityCheck-SQLInjection"/>
<error line="126" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::selectFieldValues() in \RecountCategories::doWork that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::selectFieldValues) (Caused by: maintenance/recountCategories.php 117; maintenance/recountCategories.php 82; maintenance/recountCategories.php 145)" source="SecurityCheck-SQLInjection"/>
<error line="161" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::update() in \RecountCategories::doWork that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::update) (Caused by: includes/jobqueue/JobQueueDB.php 643; maintenance/recountCategories.php 160; maintenance/recountCategories.php 82)" source="SecurityCheck-SQLInjection"/>
<error line="161" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::update() in \RecountCategories::doWork that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::update) (Caused by: maintenance/recountCategories.php 82; includes/jobqueue/JobQueueDB.php 643; maintenance/recountCategories.php 160; maintenance/recountCategories.php 160)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/refreshExternallinksIndex.php">
<error line="73" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \RefreshExternallinksIndex::doDBUpdates that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: maintenance/refreshExternallinksIndex.php 71; maintenance/populateContentTables.php 199; maintenance/refreshExternallinksIndex.php 59)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/runBatchedQuery.php">
<error line="80" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \RunBatchedQuery::execute that outputs using tainted argument $key. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: maintenance/runBatchedQuery.php 51)" source="SecurityCheck-SQLInjection"/>
<error line="80" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \RunBatchedQuery::execute that outputs using tainted argument $table. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: maintenance/runBatchedQuery.php 50)" source="SecurityCheck-SQLInjection"/>
<error line="81" severity="error" message="ORDER BY clause is user controlled (Caused by: maintenance/runBatchedQuery.php 51) (Originally at: maintenance/runBatchedQuery.php:80)" source="SecurityCheck-SQLInjection"/>
<error line="97" severity="error" message="IDatabase::makeList with LIST_AND, LIST_OR or LIST_SET must sql escape string key names and values of numeric keys (Caused by: maintenance/runBatchedQuery.php 87; maintenance/runBatchedQuery.php 92)" source="SecurityCheck-SQLInjection"/>
<error line="99" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \RunBatchedQuery::execute that outputs using tainted argument $query. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/runBatchedQuery.php 95; maintenance/runBatchedQuery.php 52)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/runScript.php">
<error line="64" severity="warning" message="Argument to require, include or eval is user controlled (Caused by: maintenance/runScript.php 57)" source="SecurityCheck-OTHER"/>
</file>
<file name="maintenance/sql.php">
<error line="112" severity="error" message="Calling method \MwSql::sqlDoQuery() in \MwSql::execute that outputs using tainted argument $query. (Caused by: maintenance/sql.php 174) (Caused by: maintenance/sql.php 111)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/sqlite.inc">
<error line="80" severity="error" message="Calling method \Wikimedia\Rdbms\DatabaseSqlite::query() in \Sqlite::checkSqlSyntax that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/Storage/NameTableStore.php 384; includes/libs/rdbms/database/DatabaseSqlite.php 607; includes/libs/rdbms/database/DatabaseSqlite.php 783; includes/libs/rdbms/database/DatabaseSqlite.php 1030; includes/libs/rdbms/database/DatabaseSqlite....)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/storage/compressOld.php">
<error line="328" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \CompressOld::compressWithConcat that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: includes/resourceloader/ResourceLoaderWikiModule.php 440; maintenance/checkBadRedirects.php 49; maintenance/deleteOldRevisions.php 64; maintenance/orphans.php 160; includes/CategoryFinder.php 216; includes/CategoryFinder.php 248; includes/api/ApiQueryInfo.php 755; includes/api/ApiQueryAllPages.php 217; includes/api/ApiQueryAllPages.php 226; includes/api/ApiQueryBacklinks.php 182; includes/api/ApiQueryBac...)" source="SecurityCheck-SQLInjection"/>
</file>
<file name="maintenance/uppercaseTitlesForUnicodeTransition.php">
<error line="153" severity="warning" message="Argument to require, include or eval is user controlled (Caused by: maintenance/uppercaseTitlesForUnicodeTransition.php 146)" source="SecurityCheck-OTHER"/>
</file>
</checkstyle>Change 589891 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/core@master] maintenance: Add @return-taint none to getArg and getOption
Change 589891 merged by jenkins-bot:
[mediawiki/core@master] maintenance: Add @return-taint none to getArg and getOption
It is possible that the new version of taint check taking mixed different as before? I seeing some false positive where mixed return type of functions seems to be involved.
<file name="maintenance\refreshExternallinksIndex.php"> <error line="76" severity="error" message="Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \RefreshExternallinksIndex::doDBUpdates that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: maintenance\refreshExternallinksIndex.php 74; maintenance\populateContentTables.php 199; maintenance\refreshExternallinksIndex.php 61)" source="SecurityCheck-SQLInjection"/> </file>
$start = $minmax->min - 1;
$last = $minmax->max;
$lbFactory = MediaWikiServices::getInstance()->getDBLoadBalancerFactory();
while ( $start < $last ) {
$end = min( $start $this->mBatchSize, $last ); // <!-- php.net document min() as mixed return type - I hope that phan can see that this would return always an int as real type
$this->output( "el_id $start - $end of $last\n" );
$res = $dbw->select( 'externallinks', [ 'el_id', 'el_to', 'el_index' ],
[
"el_id > $start",
"el_id <= $end",
],
__METHOD__,
[ 'ORDER BY' => 'el_id' ]
);Or it is a issue with objects as $minmax is a object with two int fields.
<file name="includes\specials\pagers\ImageListPager.php"> <error line="503" severity="warning" message="Calling method \MediaWiki\Linker\LinkRenderer::makeLink() in \ImageListPager::formatValue that outputs using tainted argument $name. (Caused by: Builtin-\MediaWiki\Linker\LinkRenderer::makeLink) (Caused by: includes\specials\pagers\ImageListPager.php 502)" source="SecurityCheck-DoubleEscaped"/> </file>
$name = User::whoIs( $this->mCurrentRow->img_user ); $link = $linkRenderer->makeLink( Title::makeTitle( NS_USER, $name ), $name );
The $name seems save and correct as there is no escaping involved. User::whoIs takes it data from UserCache::getProp which is documented as mixed
Change 595234 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Avoid reuse of local variable in RevisionStore
Change 595237 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Use db abstraction layer in nukePage and nukeNS maintenance script
Not in taint-check directly, as it doesn't care about types, except for a very small part.
The call to min() isn't clearing the taint from its arguments, and that's indeed because the function returns mixed. Taint-check handles internal funcs that return min as if they just preserve the taint of the arguments, and that's what it does here. However, it's always been like this AFAIK.
The $name seems save and correct as there is no escaping involved.
I can't tell for sure. Taint-check does have several false positives, but it also analyzes things very deeply, and lots of times I have found it to be right even when it didn't seem so at first.
User::whoIs takes it data from UserCache::getProp which is documented as mixed
It might or might not be related. Unlike built-in PHP functions, method are analyzed thoroughly, and the return type only plays a tiny part.
As a side note, I suggest not to worry about taint-check issues for core. Many of those are false positives, and I'm focusing on them for the next release.
But than it takes the taint of the arguments of min() different as in release before, but that looks all like int for me. Maybe needs a deeper check.
The $name seems save and correct as there is no escaping involved.
I can't tell for sure. Taint-check does have several false positives, but it also analyzes things very deeply, and lots of times I have found it to be right even when it didn't seem so at first.
User::whoIs takes it data from UserCache::getProp which is documented as mixed
It might or might not be related. Unlike built-in PHP functions, method are analyzed thoroughly, and the return type only plays a tiny part.
It seems that all user names are unsafe as seeing many places with users from the UserCache or from User::getName, very confusing. Seems also needs a deeper check.
As a side note, I suggest not to worry about taint-check issues for core. Many of those are false positives, and I'm focusing on them for the next release.
Not all, I just looking around and try to fix some of them.
This is possible, but the current is intended behaviour.
, but that looks all like int for me. Maybe needs a deeper check.
Phan hardcodes min() as returning mixed, there's nothing we can do about that -- except add a special case, like "if all arguments to min() are integers, then the return value is an integer", but that should really live inside phan, not taint-check. There's no other "deeper check" that would work, take the following:
$min = min( ['<script>alert()</script>'], [42]); echo $min[0];
It seems that all user names are unsafe as seeing many places with users from the UserCache or from User::getName, very confusing. Seems also needs a deeper check.
User names *are* unsafe, so nothing wrong here.
As a side note, I suggest not to worry about taint-check issues for core. Many of those are false positives, and I'm focusing on them for the next release.
Not all, I just looking around and try to fix some of them.
Yeah, I was just suggesting to wait for a release or two, because many issues are false positives, and there are many other false negatives that still don't show up.
It seems is the other way round. User names are treated as safe and using it in places where escaping is known (as LinkRenderer::makeLink as second argument) it is reported as DoubleEscaped.
Also pass an user name to wfEscapeWikiText reports DoubleEscaped
Taint for User::mName is polluted by Wikimedia\IPUtils::sanitizeIP.
When comment out that statement in User::getName then many issues go away (including the one listed above from ImageListPager)
Change 595255 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Improve some message escaping on special pages
Change 595234 merged by jenkins-bot:
[mediawiki/core@master] Avoid reuse of local variable in RevisionStore
Change 595237 merged by jenkins-bot:
[mediawiki/core@master] Use db abstraction layer in nukePage and nukeNS maintenance script
Change 595255 abandoned by Umherirrender:
[mediawiki/core@master] Improve some message escaping on special pages
Reason:
Outdated and seems unneeded/unwanted
With mw-phan 0.10.4 we have 157 errors, 100 of which are DoubleEscaped:
13:49:09 includes/AjaxDispatcher.php:112 UnusedSuppression Element \AjaxDispatcher::performAction suppresses issue SecurityCheck-XSS but does not use it
13:49:09 includes/CategoryViewer.php:193 SecurityCheck-DoubleEscaped Calling method \CategoryViewer::generateLink() in \CategoryViewer::addSubcategoryObject that outputs using tainted argument $[arg #4]. (Caused by: includes/CategoryViewer.php 212)
13:49:09 includes/GlobalFunctions.php:913 PhanRedundantCondition Redundant attempt to cast $wgDebugRawPage of type true to truthy
13:49:09 includes/GlobalFunctions.php:1310 PhanRedundantCondition Redundant attempt to cast $wgShowHostnames of type true to truthy
13:49:09 includes/OutputPage.php:2607 SecurityCheck-XSS Echoing expression that was not html escaped (Caused by: includes/OutputPage.php 1631; includes/OutputPage.php 1609; includes/OutputPage.php 1618; includes/OutputPage.php 2607; includes/OutputPage.php 2699; includes/OutputPage.php 4063; includes/OutputPage.php 2889; includes/OutputPage.php 2777; i...)
13:49:09 includes/actions/RawAction.php:127 SecurityCheck-DoubleEscaped Calling method \HttpError::__construct() in \RawAction::onView that outputs using tainted argument $msg. (Caused by: includes/exception/HttpError.php 125) (Caused by: includes/actions/RawAction.php 126)
13:49:09 includes/actions/RawAction.php:152 SecurityCheck-DoubleEscaped Calling method \HttpError::__construct() in \RawAction::onView that outputs using tainted argument $[arg #2]. (Caused by: includes/exception/HttpError.php 125) (Caused by: includes/GlobalFunctions.php 1228)
13:49:09 includes/api/ApiCSPReport.php:190 SecurityCheck-DoubleEscaped Calling method \ApiCSPReport::error() in \ApiCSPReport::getReport that outputs using tainted argument $msg. (Caused by: includes/api/ApiCSPReport.php 254) (Caused by: includes/api/ApiCSPReport.php 186)
13:49:09 includes/api/ApiFormatPhp.php:36 UnusedSuppression Element \ApiFormatPhp::execute suppresses issue SecurityCheck-XSS but does not use it
13:49:09 includes/api/ApiHelp.php:311 SecurityCheck-DoubleEscaped Calling method \Html::element() in \ApiHelp::getHelpInternal that outputs using tainted argument $headerContent. (Caused by: Builtin-\Html::element) (Caused by: includes/api/ApiHelp.php 278; includes/api/ApiHelp.php 287)
13:49:09 includes/api/ApiTokens.php:42 PhanParamTooManyCallable Call with 1 arg(s) to Closure() (As a provided callable) which only takes 0 arg(s) defined at includes/api/ApiTokens.php:78
13:49:09 includes/config/EtcdConfig.php:110 PhanTypeArraySuspiciousNullable Suspicious array access to $this->procCache of nullable type array|null
13:49:09 includes/config/EtcdConfig.php:116 PhanTypeArraySuspiciousNullable Suspicious array access to $this->procCache of nullable type array|null
13:49:09 includes/config/EtcdConfig.php:125 PhanTypeArraySuspiciousNullable Suspicious array access to $this->procCache of nullable type array|array<string,non-empty-mixed>|null
13:49:09 includes/exception/HttpError.php:125 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \HttpError::getHTML that outputs using tainted argument $[arg #1]. (Caused by: includes/exception/HttpError.php 125; includes/actions/RawAction.php 127)
13:49:09 includes/exception/HttpError.php:125 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \HttpError::getHTML that outputs using tainted argument $[arg #1]. (Caused by: includes/exception/HttpError.php 125; includes/actions/RawAction.php 127; includes/actions/RawAction.php 152; includes/linkeddata/PageDataRequestHandler.php 76; includes/linkeddata/PageDataRequestHandler.php 93; includes/linkeddata/PageDataRequ...)
13:49:09 includes/exception/MWException.php:115 PhanRedundantCondition Redundant attempt to cast $wgShowExceptionDetails of type true to truthy
13:49:09 includes/exception/MWException.php:152 PhanRedundantCondition Redundant attempt to cast $wgShowExceptionDetails of type true to truthy
13:49:09 includes/export/WikiExporter.php:601 SecurityCheck-XSS Calling method \DumpOutput::writeLogItem() in \WikiExporter::outputLogStream that outputs using tainted argument $output. (Caused by: includes/export/DumpOutput.php 73) (Caused by: includes/export/WikiExporter.php 600)
13:49:09 includes/htmlform/fields/HTMLFormFieldCloner.php:400 SecurityCheck-DoubleEscaped Calling method \Html::rawElement() in \HTMLFormFieldCloner::getInputHTML that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Html::rawElement) (Caused by: includes/htmlform/fields/HTMLFormFieldCloner.php 399)
13:49:09 includes/htmlform/fields/HTMLFormFieldCloner.php:472 SecurityCheck-DoubleEscaped Calling method \Html::rawElement() in \HTMLFormFieldCloner::getInputOOUI that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Html::rawElement) (Caused by: includes/htmlform/fields/HTMLFormFieldCloner.php 471)
13:49:09 includes/installer/CliInstaller.php:246 SecurityCheck-XSS Echoing expression that was not html escaped (Caused by: includes/installer/CliInstaller.php 266)
13:49:09 includes/installer/CliInstaller.php:251 SecurityCheck-XSS Echoing expression that was not html escaped (Caused by: includes/installer/CliInstaller.php 266)
13:49:09 includes/installer/DatabaseInstaller.php:688 SecurityCheck-DoubleEscaped Calling method \DatabaseInstaller::getPasswordBox() in \DatabaseInstaller::getInstallUserBox that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/DatabaseInstaller.php 589) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/DatabaseInstaller.php:688 SecurityCheck-DoubleEscaped Calling method \DatabaseInstaller::getTextBox() in \DatabaseInstaller::getInstallUserBox that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/DatabaseInstaller.php 562) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/DatabaseInstaller.php:690 SecurityCheck-DoubleEscaped Calling method \DatabaseInstaller::getTextBox() in \DatabaseInstaller::getInstallUserBox that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/DatabaseInstaller.php 562) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/DatabaseInstaller.php:696 SecurityCheck-DoubleEscaped Calling method \DatabaseInstaller::getPasswordBox() in \DatabaseInstaller::getInstallUserBox that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/DatabaseInstaller.php 589) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/Installer.php:1534 UnusedSuppression Element \Installer::includeExtensions suppresses issue SecurityCheck-OTHER but does not use it
13:49:09 includes/installer/Installer.php:1566 UnusedSuppression Element \Installer::getAutoExtensionLegacyHooks suppresses issue SecurityCheck-OTHER but does not use it
13:49:09 includes/installer/MysqlInstaller.php:82 SecurityCheck-DoubleEscaped Calling method \MysqlInstaller::getTextBox() in \MysqlInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/MysqlInstaller.php:90 SecurityCheck-DoubleEscaped Calling method \MysqlInstaller::getTextBox() in \MysqlInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/MysqlInstaller.php:92 SecurityCheck-DoubleEscaped Calling method \MysqlInstaller::getTextBox() in \MysqlInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/PostgresInstaller.php:65 SecurityCheck-DoubleEscaped Calling method \PostgresInstaller::getTextBox() in \PostgresInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/PostgresInstaller.php:74 SecurityCheck-DoubleEscaped Calling method \PostgresInstaller::getTextBox() in \PostgresInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/PostgresInstaller.php:80 SecurityCheck-DoubleEscaped Calling method \PostgresInstaller::getTextBox() in \PostgresInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/SqliteInstaller.php:90 SecurityCheck-DoubleEscaped Calling method \SqliteInstaller::getTextBox() in \SqliteInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/SqliteInstaller.php:95 SecurityCheck-DoubleEscaped Calling method \SqliteInstaller::getTextBox() in \SqliteInstaller::getConnectForm that outputs using tainted argument $[arg #4]. (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:58 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:58 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680; includes/installer/WebInstallerName.php 53; includes/installer/WebInstallerName.php 56)
13:49:09 includes/installer/WebInstallerName.php:58 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getRadioSet() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 958) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:58 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:59 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:59 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680; includes/installer/WebInstallerName.php 53; includes/installer/WebInstallerName.php 56)
13:49:09 includes/installer/WebInstallerName.php:59 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getRadioSet() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 958) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:59 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:67 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getRadioSet() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 958) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:82 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:95 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:103 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerName.php:108 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerName::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680; includes/installer/WebInstallerName.php 53; includes/installer/WebInstallerName.php 56)
13:49:09 includes/installer/WebInstallerOptions.php:117 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getRadioElements() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 1015) (Caused by: includes/installer/WebInstallerOptions.php 114; includes/installer/WebInstallerOptions.php 113)
13:49:09 includes/installer/WebInstallerOptions.php:126 SecurityCheck-DoubleEscaped Calling method \WebInstallerOptions::makeScreenshotsLink() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #2]. (Caused by: includes/installer/WebInstallerOptions.php 353) (Caused by: includes/installer/WebInstallerOptions.php 124)
13:49:09 includes/installer/WebInstallerOptions.php:128 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \WebInstallerOptions::execute that outputs using tainted argument $skin. (Caused by: includes/installer/WebInstallerOptions.php 124)
13:49:09 includes/installer/WebInstallerOptions.php:130 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstallerOptions.php 126; includes/installer/WebInstallerOptions.php 128; includes/installer/WebInstallerOptions.php 124)
13:49:09 includes/installer/WebInstallerOptions.php:131 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstallerOptions.php 126; includes/installer/WebInstallerOptions.php 128; includes/installer/WebInstallerOptions.php 124)
13:49:09 includes/installer/WebInstallerOptions.php:132 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstallerOptions.php 126; includes/installer/WebInstallerOptions.php 128; includes/installer/WebInstallerOptions.php 124)
13:49:09 includes/installer/WebInstallerOptions.php:178 SecurityCheck-DoubleEscaped Calling method \Html::element() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Html::element) (Caused by: includes/installer/WebInstallerOptions.php 124; includes/installer/WebInstallerOptions.php 124; includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175)
13:49:09 includes/installer/WebInstallerOptions.php:200 SecurityCheck-DoubleEscaped Calling method \Html::element() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Html::element) (Caused by: includes/installer/WebInstallerOptions.php 199)
13:49:09 includes/installer/WebInstallerOptions.php:200 SecurityCheck-DoubleEscaped Calling method \Html::element() in \WebInstallerOptions::execute that outputs using tainted argument $name. (Caused by: Builtin-\Html::element) (Caused by: includes/installer/WebInstallerOptions.php 199)
13:49:09 includes/installer/WebInstallerOptions.php:209 SecurityCheck-DoubleEscaped Calling method \Html::element() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Html::element) (Caused by: includes/installer/WebInstallerOptions.php 199; includes/installer/WebInstallerOptions.php 208)
13:49:09 includes/installer/WebInstallerOptions.php:209 SecurityCheck-DoubleEscaped Calling method \Html::element() in \WebInstallerOptions::execute that outputs using tainted argument $name. (Caused by: Builtin-\Html::element) (Caused by: includes/installer/WebInstallerOptions.php 199; includes/installer/WebInstallerOptions.php 208)
13:49:09 includes/installer/WebInstallerOptions.php:217 SecurityCheck-XSS Calling method \Message::rawParams() in \WebInstallerOptions::execute that outputs using tainted argument $ext. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175) (Param is raw)
13:49:09 includes/installer/WebInstallerOptions.php:223 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstallerOptions.php 180; includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175; includes/installer/WebInstallerOptions.php 217; includes/installer/WebInstallerOptions.php 221; includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175; includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175)
13:49:09 includes/installer/WebInstallerOptions.php:236 SecurityCheck-DoubleEscaped Calling method \Xml::encodeJsVar() in \WebInstallerOptions::execute that outputs using tainted argument $dependencyMap. (Caused by: Builtin-\Xml::encodeJsVar) (Caused by: includes/installer/WebInstallerOptions.php 187; includes/installer/WebInstallerOptions.php 124; includes/installer/WebInstallerOptions.php 124; includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175; incl...)
13:49:09 includes/installer/WebInstallerOptions.php:237 SecurityCheck-DoubleEscaped Calling method \Xml::encodeJsVar() in \WebInstallerOptions::execute that outputs using tainted argument $dependencyMap. (Caused by: Builtin-\Xml::encodeJsVar) (Caused by: includes/installer/WebInstallerOptions.php 187; includes/installer/WebInstallerOptions.php 124; includes/installer/WebInstallerOptions.php 124; includes/installer/WebInstallerOptions.php 160; includes/installer/WebInstallerOptions.php 175; incl...)
13:49:09 includes/installer/WebInstallerOptions.php:250 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:250 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:252 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:252 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:253 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:260 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:267 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 793) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:274 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:275 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getCheckBox() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 922; includes/installer/WebInstaller.php 920) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:302 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextArea() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 840) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:304 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextArea() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 840) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/installer/WebInstallerOptions.php:318 SecurityCheck-DoubleEscaped Calling method \WebInstaller::getTextArea() in \WebInstallerOptions::execute that outputs using tainted argument $[arg #1]. (Caused by: includes/installer/WebInstaller.php 840) (Caused by: includes/installer/WebInstaller.php 680)
13:49:09 includes/jobqueue/utils/BacklinkJobUtils.php:102 SecurityCheck-SQLInjection Calling method \BacklinkCache::partition() in \BacklinkJobUtils::partitionBacklinkJob that outputs using tainted argument $[arg #1]. (Caused by: includes/cache/BacklinkCache.php 443) (Caused by: includes/jobqueue/utils/BacklinkJobUtils.php 90)
13:49:09 includes/language/Message.php:916 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \Message::__toString that outputs using tainted argument $[arg #1]. (Caused by: includes/language/Message.php 272)
13:49:09 includes/language/Message.php:916 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \Message::__toString that outputs using tainted argument $[arg #1]. (Caused by: includes/language/Message.php 272; includes/language/Message.php 1299; includes/language/Message.php 1290)
13:49:09 includes/language/Message.php:1377 SecurityCheck-DoubleEscaped Calling method \Message::extractParam() in \Message::formatListParam that outputs using tainted argument $[arg #1]. (Caused by: includes/language/Message.php 1190; includes/language/Message.php 1226)
13:49:09 includes/libs/rdbms/database/DatabaseSqlite.php:1030 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\DatabaseSqlite::query() in \Wikimedia\Rdbms\DatabaseSqlite::duplicateTableStructure that outputs using tainted argument $sql. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/libs/rdbms/database/DatabaseSqlite.php 1013; includes/libs/rdbms/database/DatabaseSqlite.php 1026)
13:49:09 includes/libs/rdbms/database/DatabaseSqlite.php:1064 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\DatabaseSqlite::query() in \Wikimedia\Rdbms\DatabaseSqlite::duplicateTableStructure that outputs using tainted argument $sql. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/libs/rdbms/database/DatabaseSqlite.php 1050; includes/libs/rdbms/database/DatabaseSqlite.php 1049; includes/Storage/NameTableStore.php 384; includes/libs/rdbms/database/DatabaseSqlite.php 606; includes/libs/rdbms/database/DatabaseSqlite...)
13:49:09 includes/libs/rdbms/database/resultwrapper/FakeResultWrapper.php:42 PhanTypeArraySuspiciousNullable Suspicious array access to $this->result of nullable type \stdClass[]|array[]|null
13:49:09 includes/libs/rdbms/lbfactory/LBFactory.php:455 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanImpossibleConditionInLoop on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/libs/stats/BufferingStatsdDataFactory.php:79 PhanUndeclaredMethod Call to undeclared method \Liuggio\StatsdClient\Entity\StatsdDataInterface::setKey (Did you mean expr->getKey())
13:49:09 includes/libs/stats/BufferingStatsdDataFactory.php:82 PhanUndeclaredMethod Call to undeclared method \Liuggio\StatsdClient\Entity\StatsdDataInterface::setValue (Did you mean expr->getValue())
13:49:09 includes/libs/stats/BufferingStatsdDataFactory.php:85 PhanUndeclaredMethod Call to undeclared method \Liuggio\StatsdClient\Entity\StatsdDataInterface::setMetric (Did you mean expr->getMetric())
13:49:09 includes/linkeddata/PageDataRequestHandler.php:76 SecurityCheck-DoubleEscaped Calling method \HttpError::__construct() in \PageDataRequestHandler::handleRequest that outputs using tainted argument $[arg #2]. (Caused by: includes/exception/HttpError.php 125) (Caused by: includes/GlobalFunctions.php 1228)
13:49:09 includes/linkeddata/PageDataRequestHandler.php:93 SecurityCheck-DoubleEscaped Calling method \HttpError::__construct() in \PageDataRequestHandler::handleRequest that outputs using tainted argument $[arg #2]. (Caused by: includes/exception/HttpError.php 125) (Caused by: includes/GlobalFunctions.php 1228; includes/linkeddata/PageDataRequestHandler.php 85)
13:49:09 includes/linkeddata/PageDataRequestHandler.php:99 SecurityCheck-DoubleEscaped Calling method \HttpError::__construct() in \PageDataRequestHandler::handleRequest that outputs using tainted argument $[arg #2]. (Caused by: includes/exception/HttpError.php 125) (Caused by: includes/GlobalFunctions.php 1228; includes/linkeddata/PageDataRequestHandler.php 97)
13:49:09 includes/linkeddata/PageDataRequestHandler.php:150 SecurityCheck-DoubleEscaped Calling method \HttpError::__construct() in \PageDataRequestHandler::httpContentNegotiation that outputs using tainted argument $msg. (Caused by: includes/exception/HttpError.php 125) (Caused by: includes/linkeddata/PageDataRequestHandler.php 149)
13:49:09 includes/logging/BlockLogFormatter.php:98 SecurityCheck-XSS Calling method \Message::rawParams() in \BlockLogFormatter::getMessageParameters that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/BlockLogFormatter.php 82) (Param is raw)
13:49:09 includes/logging/BlockLogFormatter.php:104 SecurityCheck-XSS Calling method \Message::rawParams() in \BlockLogFormatter::getMessageParameters that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/BlockLogFormatter.php 87) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:263 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:268 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:281 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:285 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:308 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:314 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:318 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:324 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:339 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:352 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:357 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:376 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:380 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:387 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:410 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $duration. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 404) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:410 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:414 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:425 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $duration. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 418) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:425 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:434 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogFormatter.php:438 SecurityCheck-XSS Calling method \Message::rawParams() in \LogFormatter::getIRCActionText that outputs using tainted argument $target. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogFormatter.php 255) (Param is raw)
13:49:09 includes/logging/LogPage.php:255 SecurityCheck-XSS Calling method \Message::rawParams() in \LogPage::actionText that outputs using tainted argument $titleLink. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/logging/LogPage.php 252) (Param is raw)
13:49:09 includes/media/ExifBitmapHandler.php:75 SecurityCheck-DoubleEscaped Calling method \FormatMetadata::flattenArrayReal() in \ExifBitmapHandler::convertMetadataVersion that outputs using tainted argument $val. (Caused by: includes/media/FormatMetadata.php 1205) (Caused by: includes/media/ExifBitmapHandler.php 73)
13:49:09 includes/page/ImagePage.php:172 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \ImagePage::view that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/page/ImagePage.php 724; includes/page/ImagePage.php 700)
13:49:09 includes/page/ImagePage.php:449 SecurityCheck-DoubleEscaped Calling method \Linker::makeThumbLinkObj() in \ImagePage::openShowImage that outputs using tainted argument $link. (Caused by: includes/Linker.php 504) (Caused by: includes/page/ImagePage.php 443)
13:49:09 includes/page/ImagePage.php:469 SecurityCheck-DoubleEscaped Calling method \Linker::makeThumbLinkObj() in \ImagePage::openShowImage that outputs using tainted argument $link. (Caused by: includes/Linker.php 504) (Caused by: includes/page/ImagePage.php 463)
13:49:09 includes/parser/CoreTagHooks.php:58 UnusedSuppression Element \CoreTagHooks::pre suppresses issue SecurityCheck-XSS but does not use it
13:49:09 includes/parser/PPTemplateFrame_Hash.php:65 PhanTypeMismatchForeach float|int passed to foreach instead of array
13:49:09 includes/parser/Parser.php:3246 SecurityCheck-XSS Calling method \Parser::insertStripItem() in \Parser::braceSubstitution that outputs using tainted argument $text. (Caused by: includes/parser/Parser.php 1304) (Caused by: includes/parser/Parser.php 2995; includes/parser/Parser.php 3089; includes/parser/Parser.php 2995; includes/parser/Parser.php 3191; includes/parser/Parser.php 3170; includes/parser/Parser.php 3080; includes/parser/Parser.php 3133; includes/pa...)
13:49:09 includes/parser/Parser.php:3249 SecurityCheck-DoubleEscaped Calling method \wfEscapeWikiText() in \Parser::braceSubstitution that outputs using tainted argument $text. (Caused by: includes/GlobalFunctions.php 1494) (Caused by: includes/parser/Parser.php 2995; includes/parser/Parser.php 3089; includes/parser/Parser.php 2995; includes/parser/Parser.php 3191; includes/parser/Parser.php 3170; includes/parser/Parser.php 3080; includes/parser/Parser.php 3133; includes/pa...)
13:49:09 includes/preferences/DefaultPreferencesFactory.php:806 SecurityCheck-XSS HTMLForm option label needs escaping (Maybe false positive as could not determine if it was key or value that is unescaped) (Caused by: includes/preferences/DefaultPreferencesFactory.php 803)
13:49:09 includes/resourceloader/ResourceLoader.php:1137 PhanRedundantCondition Redundant attempt to cast $wgShowExceptionDetails of type true to truthy
13:49:09 includes/skins/Skin.php:2028 UnusedSuppression Element \Skin::doEditSectionLink suppresses issue SecurityCheck-XSS but does not use it
13:49:09 includes/specials/SpecialChangeCredentials.php:179 SecurityCheck-DoubleEscaped Calling method \Html::element() in \SpecialChangeCredentials::getAuthForm that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Html::element) (Caused by: includes/specials/SpecialChangeCredentials.php 177)
13:49:09 includes/specials/SpecialChangeCredentials.php:180 SecurityCheck-DoubleEscaped Calling method \Html::element() in \SpecialChangeCredentials::getAuthForm that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Html::element) (Caused by: includes/specials/SpecialChangeCredentials.php 177)
13:49:09 includes/specials/SpecialChangeCredentials.php:182 SecurityCheck-DoubleEscaped Calling method \Html::element() in \SpecialChangeCredentials::getAuthForm that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Html::element) (Caused by: includes/specials/SpecialChangeCredentials.php 177)
13:49:09 includes/specials/SpecialChangeCredentials.php:184 SecurityCheck-DoubleEscaped Calling method \Html::element() in \SpecialChangeCredentials::getAuthForm that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Html::element) (Caused by: includes/specials/SpecialChangeCredentials.php 177)
13:49:09 includes/specials/SpecialChangeCredentials.php:237 SecurityCheck-DoubleEscaped Calling method \MediaWiki\Linker\LinkRenderer::makeLink() in \SpecialChangeCredentials::showSubpageList that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\MediaWiki\Linker\LinkRenderer::makeLink) (Caused by: includes/specials/SpecialChangeCredentials.php 236)
13:49:09 includes/specials/SpecialChangeCredentials.php:238 SecurityCheck-DoubleEscaped Calling method \MediaWiki\Linker\LinkRenderer::makeLink() in \SpecialChangeCredentials::showSubpageList that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\MediaWiki\Linker\LinkRenderer::makeLink) (Caused by: includes/specials/SpecialChangeCredentials.php 236)
13:49:09 includes/specials/SpecialExpandTemplates.php:149 SecurityCheck-DoubleEscaped Calling method \SpecialExpandTemplates::makeOutput() in \SpecialExpandTemplates::execute that outputs using tainted argument $rawhtml. (Caused by: includes/specials/SpecialExpandTemplates.php 246) (Caused by: includes/specials/SpecialExpandTemplates.php 147)
13:49:09 includes/specials/SpecialRecentChanges.php:502 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \SpecialRecentChanges::outputChangesList that outputs using tainted argument $rclistOutput. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/specials/SpecialRecentChanges.php 443; includes/specials/SpecialRecentChanges.php 443; includes/specials/SpecialRecentChanges.php 443; includes/specials/SpecialRecentChanges.php 490; includes/specials/SpecialRecentChanges.php 494)
13:49:09 includes/specials/SpecialRecentChanges.php:538 SecurityCheck-DoubleEscaped Calling method \Xml::tags() in \SpecialRecentChanges::doHeader that outputs using tainted argument $[arg #2]. (Caused by: Builtin-\Xml::tags) (Caused by: includes/specials/SpecialRecentChanges.php 531)
13:49:09 includes/specials/SpecialRecentChanges.php:814 SecurityCheck-DoubleEscaped Calling method \SpecialRecentChanges::makeOptionsLink() in \SpecialRecentChanges::optionsPanel that outputs using tainted argument $[arg #1]. (Caused by: includes/specials/SpecialRecentChanges.php 780)
13:49:09 includes/specials/SpecialRecentChanges.php:911 SecurityCheck-DoubleEscaped Calling method \SpecialRecentChanges::makeOptionsLink() in \SpecialRecentChanges::optionsPanel that outputs using tainted argument $[arg #1]. (Caused by: includes/specials/SpecialRecentChanges.php 780) (Caused by: Builtin-\Message::parse; includes/language/Message.php 929)
13:49:09 includes/specials/SpecialRecentChanges.php:914 SecurityCheck-DoubleEscaped Calling method \SpecialRecentChanges::makeOptionsLink() in \SpecialRecentChanges::optionsPanel that outputs using tainted argument $[arg #1]. (Caused by: includes/specials/SpecialRecentChanges.php 780) (Caused by: Builtin-\Message::parse; includes/language/Message.php 929)
13:49:09 includes/specials/SpecialUndelete.php:1137 SecurityCheck-XSS Calling method \Message::rawParams() in \SpecialUndelete::formatRevisionRow that outputs using tainted argument $pageLink. (Caused by: Builtin-\Message::rawParams) (Caused by: includes/specials/SpecialUndelete.php 1088; includes/specials/SpecialUndelete.php 1091; includes/specials/SpecialUndelete.php 1103; includes/specials/SpecialUndelete.php 1107) (Param is raw)
13:49:09 includes/specials/SpecialUserrights.php:776 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \UserrightsPage::showEditUserGroupsForm that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/specials/SpecialUserrights.php 710; includes/specials/SpecialUserrights.php 714; includes/specials/SpecialUserrights.php 696; includes/specials/SpecialUserrights.php 723; includes/specials/SpecialUserrights.php 719; includes/specials/S... includes/specials/SpecialUserrights.php 743)
13:49:09 includes/specials/SpecialVersion.php:642 SecurityCheck-DoubleEscaped Calling method \Linker::makeExternalLink() in \SpecialVersion::getParserTags that outputs using tainted argument $[arg #2]. (Caused by: includes/Linker.php 846) (Caused by: Builtin-\Message::parse; includes/language/Message.php 929)
13:49:09 includes/specials/SpecialVersion.php:648 SecurityCheck-DoubleEscaped Calling method \Linker::makeExternalLink() in \SpecialVersion::getParserTags that outputs using tainted argument $[arg #2]. (Caused by: includes/Linker.php 846) (Caused by: Builtin-\Message::parse; includes/language/Message.php 929)
13:49:09 includes/specials/SpecialVersion.php:683 SecurityCheck-DoubleEscaped Calling method \Linker::makeExternalLink() in \SpecialVersion::getParserFunctionHooks that outputs using tainted argument $[arg #2]. (Caused by: includes/Linker.php 846) (Caused by: Builtin-\Message::parse; includes/language/Message.php 929)
13:49:09 includes/specials/SpecialVersion.php:689 SecurityCheck-DoubleEscaped Calling method \Linker::makeExternalLink() in \SpecialVersion::getParserFunctionHooks that outputs using tainted argument $[arg #2]. (Caused by: includes/Linker.php 846) (Caused by: Builtin-\Message::parse; includes/language/Message.php 929)
13:49:09 includes/specials/SpecialVersion.php:839 SecurityCheck-DoubleEscaped Calling method \Linker::makeExternalLink() in \SpecialVersion::getCreditsForExtension that outputs using tainted argument $[arg #2]. (Caused by: includes/Linker.php 846)
13:49:09 includes/specials/SpecialWatchlist.php:603 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \SpecialWatchlist::outputChangesList that outputs using tainted argument $s. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/specials/SpecialWatchlist.php 558; includes/specials/SpecialWatchlist.php 558; includes/specials/SpecialWatchlist.php 558; includes/specials/SpecialWatchlist.php 598; includes/specials/SpecialWatchlist.php 601)
13:49:09 includes/specials/SpecialWatchlist.php:764 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \SpecialWatchlist::doHeader that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: Builtin-\Html::rawElement; Builtin-\Html::rawElement; Builtin-\Html::rawElement; Builtin-\Html::rawElement; includes/api/ApiFormatBase.php 276; includes/api/ApiFormatBase.php 283; includes/EditPage.php 3660; includes/EditPage.php 3020; includes/EditPage.php 3170; includes/EditPage.php 3173; includes/page/ImagePage.php 932... includes/specials/SpecialWatchlist.php 748; includes/specials/SpecialWatchlist.php 628; includes/specials/SpecialWatchlist.php 633; includes/specials/SpecialWatchlist.php 634; includes/specials/SpecialWatchlist.php 638; includes/specials/SpecialWatchlist.php 628; includes/specials/Specia...)
13:49:09 includes/specials/SpecialWatchlist.php:776 SecurityCheck-XSS Calling method \OutputPage::addHTML() in \SpecialWatchlist::doHeader that outputs using tainted argument $form. (Caused by: Builtin-\OutputPage::addHTML) (Caused by: includes/specials/SpecialWatchlist.php 628; includes/specials/SpecialWatchlist.php 633; includes/specials/SpecialWatchlist.php 634; includes/specials/SpecialWatchlist.php 638; includes/specials/SpecialWatchlist.php 628; includes/specials/Specia...)
13:49:09 includes/specials/SpecialWhatLinksHere.php:444 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::wlhLink() in \SpecialWhatLinksHere::listItem that outputs using tainted argument $[arg #2]. (Caused by: includes/specials/SpecialWhatLinksHere.php 473) (Caused by: includes/specials/SpecialWhatLinksHere.php 400)
13:49:09 includes/specials/SpecialWhatLinksHere.php:444 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::wlhLink() in \SpecialWhatLinksHere::listItem that outputs using tainted argument $[arg #3]. (Caused by: includes/specials/SpecialWhatLinksHere.php 493) (Caused by: includes/specials/SpecialWhatLinksHere.php 400)
13:49:09 includes/specials/SpecialWhatLinksHere.php:528 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::makeSelfLink() in \SpecialWhatLinksHere::getPrevNext that outputs using tainted argument $prev. (Caused by: includes/specials/SpecialWhatLinksHere.php 510) (Caused by: includes/specials/SpecialWhatLinksHere.php 520)
13:49:09 includes/specials/SpecialWhatLinksHere.php:532 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::makeSelfLink() in \SpecialWhatLinksHere::getPrevNext that outputs using tainted argument $next. (Caused by: includes/specials/SpecialWhatLinksHere.php 510) (Caused by: includes/specials/SpecialWhatLinksHere.php 521)
13:49:09 includes/specials/SpecialWhatLinksHere.php:540 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::makeSelfLink() in \SpecialWhatLinksHere::getPrevNext that outputs using tainted argument $prettyLimit. (Caused by: includes/specials/SpecialWhatLinksHere.php 510) (Caused by: includes/specials/SpecialWhatLinksHere.php 538)
13:49:09 includes/specials/SpecialWhatLinksHere.php:634 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::makeSelfLink() in \SpecialWhatLinksHere::getFilterPanel that outputs using tainted argument $msg. (Caused by: includes/specials/SpecialWhatLinksHere.php 510) (Caused by: includes/specials/SpecialWhatLinksHere.php 632; includes/specials/SpecialWhatLinksHere.php 615; includes/specials/SpecialWhatLinksHere.php 616)
13:49:09 includes/specials/SpecialWhatLinksHere.php:635 SecurityCheck-DoubleEscaped Calling method \SpecialWhatLinksHere::makeSelfLink() in \SpecialWhatLinksHere::getFilterPanel that outputs using tainted argument $msg. (Caused by: includes/specials/SpecialWhatLinksHere.php 510) (Caused by: includes/specials/SpecialWhatLinksHere.php 632; includes/specials/SpecialWhatLinksHere.php 615; includes/specials/SpecialWhatLinksHere.php 616)
13:49:09 includes/specials/forms/UploadForm.php:177 SecurityCheck-XSS HTMLForm info field in raw mode needs to escape default key (Caused by: includes/specials/SpecialUpload.php 290)
13:49:09 includes/specials/forms/UploadForm.php:344 SecurityCheck-XSS HTMLForm info field in raw mode needs to escape default key (Caused by: includes/specials/SpecialUpload.php 290)
13:49:09 includes/specials/pagers/AllMessagesTablePager.php:301 SecurityCheck-DoubleEscaped Calling method \MediaWiki\Linker\LinkRenderer::makeKnownLink() in \AllMessagesTablePager::formatValue that outputs using tainted argument $talkLink. (Caused by: Builtin-\MediaWiki\Linker\LinkRenderer::makeKnownLink) (Caused by: includes/specials/pagers/AllMessagesTablePager.php 291)
13:49:09 includes/specials/pagers/AllMessagesTablePager.php:303 SecurityCheck-DoubleEscaped Calling method \MediaWiki\Linker\LinkRenderer::makeBrokenLink() in \AllMessagesTablePager::formatValue that outputs using tainted argument $talkLink. (Caused by: includes/linker/LinkRenderer.php 293) (Caused by: includes/specials/pagers/AllMessagesTablePager.php 291)
13:49:09 includes/specials/pagers/AllMessagesTablePager.php:339 SecurityCheck-DoubleEscaped Calling method \Html::element() in \AllMessagesTablePager::formatRow that outputs using tainted argument $formatted. (Caused by: Builtin-\Html::element) (Caused by: includes/specials/pagers/AllMessagesTablePager.php 333)
13:49:09 includes/user/User.php:316 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:338 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:494 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:775 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanImpossibleCondition on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/user/User.php:824 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanRedundantCondition on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/user/User.php:1489 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 languages/Language.php:4130 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \Language::translateBlockExpiry that outputs using tainted argument $[arg #1]. (Caused by: languages/Language.php 4128)
13:49:09 languages/Language.php:4137 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \Language::translateBlockExpiry that outputs using tainted argument $[arg #1]. (Caused by: languages/Language.php 4128; languages/Language.php 4135)
13:49:09 languages/LanguageConverter.php:1289 SecurityCheck-DoubleEscaped Calling method \htmlspecialchars() in \LanguageConverter::convertHtml that outputs using tainted argument $[arg #1]. (Caused by: languages/LanguageConverter.php 710; languages/LanguageConverter.php 710)
13:49:09 maintenance/Sqlite.php:81 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\DatabaseSqlite::query() in \Sqlite::checkSqlSyntax that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\Database::query) (Caused by: includes/Storage/NameTableStore.php 384; includes/libs/rdbms/database/DatabaseSqlite.php 606; includes/libs/rdbms/database/DatabaseSqlite.php 782; includes/libs/rdbms/database/DatabaseSqlite.php 1038; includes/libs/rdbms/database/DatabaseSqlite....)
13:49:09 maintenance/convertLinks.php:227 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\IMaintainableDatabase::query() in \ConvertLinks::execute that outputs using tainted argument $[arg #1]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::query) (Caused by: maintenance/convertLinks.php 215; maintenance/convertLinks.php 211; maintenance/convertLinks.php 158; maintenance/convertLinks.php 207; maintenance/convertLinks.php 210; maintenance/convertLinks.php 163; includes/installer/MysqlUpdater.php 68...)
13:49:09 maintenance/eval.php:78 SecurityCheck-OTHER Argument to require, include or eval is user controlled (Caused by: maintenance/eval.php 64)
13:49:09 maintenance/populateContentTables.php:217 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\IDatabase::select() in \PopulateContentTables::populateTable that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IDatabase::select) (Caused by: maintenance/populateContentTables.php 216; maintenance/populateContentTables.php 215; maintenance/populateContentTables.php 199)
13:49:09 maintenance/recountCategories.php:126 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\IMaintainableDatabase::selectFieldValues() in \RecountCategories::doWork that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::selectFieldValues) (Caused by: maintenance/recountCategories.php 117; maintenance/recountCategories.php 145)
13:49:09 maintenance/refreshExternallinksIndex.php:76 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \RefreshExternallinksIndex::doDBUpdates that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: maintenance/refreshExternallinksIndex.php 74; maintenance/populateContentTables.php 199; maintenance/refreshExternallinksIndex.php 61)
13:49:09 maintenance/runScript.php:64 SecurityCheck-OTHER Argument to require, include or eval is user controlled (Caused by: maintenance/runScript.php 57)
13:49:09 maintenance/storage/compressOld.php:330 SecurityCheck-SQLInjection Calling method \Wikimedia\Rdbms\IMaintainableDatabase::select() in \CompressOld::compressWithConcat that outputs using tainted argument $[arg #3]. (Caused by: Builtin-\Wikimedia\Rdbms\IMaintainableDatabase::select) (Caused by: includes/resourceloader/ResourceLoaderWikiModule.php 443; includes/page/PageArchive.php 569; includes/cache/MessageCache.php 535; includes/cache/MessageCache.php 535; includes/cache/MessageCache.php 580; maintenance/checkBadRedirects.php 55; m... includes/cache/LinkCache.php 278; includes/cache/LinkCache.php 297; includes/Title.php 3460; includes/api/ApiQueryInfo.php 740; includes/api/ApiQueryAllPages.php 221; includes/api/ApiQueryAllPages.php 230; includes/api/ApiQueryBacklinks.php 1...)Instead, if I use taint-check master, I get 218 errors, 125 of which are double-escaped. This is more similar to T216348#6007521, but I don't really know what caused it.
Guess we'll have to wait another bit.
13:49:09 includes/GlobalFunctions.php:913 PhanRedundantCondition Redundant attempt to cast $wgDebugRawPage of type true to truthy
13:49:09 includes/GlobalFunctions.php:1310 PhanRedundantCondition Redundant attempt to cast $wgShowHostnames of type true to truthy
13:49:09 includes/user/User.php:316 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:338 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:494 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:775 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanImpossibleCondition on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/user/User.php:824 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanRedundantCondition on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/user/User.php:1489 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthyThe globals are set by Installer and Maintenance and Setup, that seems to "leak" into the type check for all classes/files and results in the issues reports. Seems odd to suppress.
Is there a way to not leak types from one class to another?
Without taint phan does not have a problem with it.
Change 643978 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Add some int casts for queries in maintenance scripts
Change 643981 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Improve code around internal queries in sqlite database class
13:49:09 includes/jobqueue/utils/BacklinkJobUtils.php:102 SecurityCheck-SQLInjection Calling method \BacklinkCache::partition() in \BacklinkJobUtils::partitionBacklinkJob that outputs using tainted argument #1 (`$params['table']`). (Caused by: includes/cache/BacklinkCache.php 443) (Caused by: includes/jobqueue/utils/BacklinkJobUtils.php 90)
This could be a false positive: Variable $params has taintedness: YES
Change 643978 merged by jenkins-bot:
[mediawiki/core@master] Add some int casts for queries in maintenance scripts
The annotation still doesn't print the whole taintedness object. Could you please tryapplying the following hack to vendor/mediawiki/phan-taint-check-plugin/src/SecurityCheckPlugin.php
$msg = "Variable {CODE} has taintedness: {DETAILS}"; // Line 246
echo "\n\n$taint\n\n"; // Add this lineand then re-running phan. It should print the whole shape.
Change 643993 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Don't leak global variables in global scope
$taint is equal to {DETAILS}, but what about var_export( $var->taintedness )?
SecurityCheckPlugin\Taintedness::__set_state(array(
'flags' => 43688,
'dimTaint' =>
array (
'namespace' =>
SecurityCheckPlugin\Taintedness::__set_state(array(
'flags' => 0,
'dimTaint' =>
array (
),
'unknownDimsTaint' => 0,
)),
'title' =>
SecurityCheckPlugin\Taintedness::__set_state(array(
'flags' => 0,
'dimTaint' =>
array (
),
'unknownDimsTaint' => 0,
)),
'requestId' =>
SecurityCheckPlugin\Taintedness::__set_state(array(
'flags' => 43688,
'dimTaint' =>
array (
),
'unknownDimsTaint' => 0,
)),
),
'unknownDimsTaint' => 0,
))In Job.php:
$this->params = $params [ 'requestId' => WebRequest::getRequestId() ];
When comment out that line, everything is fine ...
Oh yes, I meant $var->taintedness. No need to var_export it though, it has a __toString() which pretty-prints the object.
[ object snip ]
Seems like it's picking up taintedness in an offset it can't resolve.
In Job.php:
$this->params = $params [ 'requestId' => WebRequest::getRequestId() ];When comment out that line, everything is fine ...
I'd have to investigate, could you please copy these comments to a new task while I take a look?
Change 643996 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Add int casts/htmlspecialchars for prints in maintenance scripts
Change 644005 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Suppress taint-check in UploadForm
Change 644006 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Suppress taint-check in DefaultPreferencesFactory
Change 644017 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Annotate File::getDescriptionText to return safe html for taint-check
Change 644019 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Suppress taint-check issues in Parser
Change 644020 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Suppress taint-check issues in LogFormatter/LogPage
False positive:
13:49:09 includes/export/WikiExporter.php:601 SecurityCheck-XSS Calling method \DumpOutput::writeLogItem() in \WikiExporter::outputLogStream that outputs using tainted argument $output. (Caused by: includes/export/DumpOutput.php 73) (Caused by: includes/export/WikiExporter.php 600)
\Xml::elementClean needs to be part of taint-check similar to \Xml::element to fix this
The static Message::rawParam is not part of the taint-check. It is possible to rewrite ->rawParams() with ->params( Message:rawParam() ) to bypass the checks.
! In T216348#6654152, @Umherirrender wrote:
The static Message::rawParam is not part of the taint-check. It is possible to rewrite ->rawParams() with ->params( Message:rawParam() ) to bypass the checks.
These can, and probably should, be annotated directly in MW core. I think we were moving away from hardcoded taint data.
Change 644006 merged by jenkins-bot:
[mediawiki/core@master] Suppress taint-check in DefaultPreferencesFactory
Change 644020 merged by jenkins-bot:
[mediawiki/core@master] Suppress taint-check issues in LogFormatter/LogPage
Change 644005 merged by jenkins-bot:
[mediawiki/core@master] Suppress taint-check in UploadForm
Change 643981 merged by jenkins-bot:
[mediawiki/core@master] Improve code around internal queries in sqlite database class
Change 647804 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Add taint hints for message creation method
Change 648368 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Document HttpError to help taint-check
Change 648379 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] Suppress taint-check issues related to Linker functions
Change 648368 merged by jenkins-bot:
[mediawiki/core@master] Document HttpError to help taint-check
Change 643993 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Don't leak global variables in global scope
FTR, current taint-check master yields 159 total issues on a slightly oudated clone of mw core, whereas taint-check 3.1.0 has 182.
Correction, it wasn't the current master. The *real* current master, which includes a fix for T269895, finds 151 issues.
Change 647804 merged by jenkins-bot:
[mediawiki/core@master] Add taint hints for message creation method
Change 643996 merged by jenkins-bot:
[mediawiki/core@master] Suppress taint-check issues in maintenance scripts/cli context
Running core with taint-check gives also many
Plugin BuiltinSuppressionPlugin suppresses issue PhanImpossibleCondition on this line but this suppression is unused or suppressed elsewhere
It seems that taint-check deeper analyze as phan and allows other decision. But I am not sure if that could be a bug in taint-check or just in phan itself
It seems I have mixed it with the update to newer phan - fixed with https://gerrit.wikimedia.org/r/c/mediawiki/core/ /648544
There are three places:
includes\libs\rdbms\lbfactory\LBFactory.php line 458
UnusedPluginSuppression: Plugin BuiltinSuppressionPlugin suppresses issue PhanImpossibleConditionInLoop on this line but this suppression is unused or suppressed elsewhere
for this code:
// No writes since the last replication wait ( // @phan-suppress-next-line PhanImpossibleConditionInLoop $opts['ifWritesSince'] && $lb->lastMasterChangeTimestamp() < $opts['ifWritesSince'] )
It seems taint-check analyze the array plus better than phan itself (phan seems not to assume that this can change by the existing array on the left side of the array plus):
$opts = [ 'domain' => false, 'cluster' => false, 'timeout' => $this->replicationWaitTimeout, 'ifWritesSince' => null ];
Same on includes\user\User.php for line 800 and 849
// @phan-suppress-next-line PhanImpossibleCondition
if ( !$options['create'] ) {
// No.
return null;
}
[...]
// @phan-suppress-next-line PhanRedundantCondition
if ( !$options['steal'] ) {
return null;
}for this array
$options = [ 'validate' => UserNameUtils::RIGOR_VALID, 'create' => true, 'steal' => false, ];
Some PhanTypeArraySuspiciousNullable also showing up.
One in FakeResultWrapper line 42, but there is a similiar suppression for the same variable in that file, seems okay for me
Three in EtcdConfig with lazy inited procCache class property. It is seems always set after the load(), thats also okay for me
Change 644019 abandoned by Umherirrender:
[mediawiki/core@master] Suppress taint-check issues in Parser
Reason:
It seems better to set the suppression together with enabling the feature
Change 648379 abandoned by Umherirrender:
[mediawiki/core@master] Suppress taint-check issues related to Linker functions
Reason:
It seems better to set the suppression together with enabling the feature
Change 644017 abandoned by Umherirrender:
[mediawiki/core@master] Annotate File::getDescriptionText to return safe html for taint-check
Reason:
It seems better to set the taint annotation together with enabling the feature
Change 652553 had a related patch set uploaded (by Umherirrender; owner: Umherirrender):
[mediawiki/core@master] build: Enable phan-taint-check-plugin and suppress issues
Change 652553 merged by jenkins-bot:
[mediawiki/core@master] build: Enable phan-taint-check-plugin and suppress issues
Change 522419 abandoned by Daimona Eaytoy:
[mediawiki/core@master] [WIP] Add phan-taint-check-plugin
Reason:
Already done
Change 491039 abandoned by Umherirrender:
[mediawiki/core@master] Various fixes to Block.php to make phan-taint-check happy
Reason:
Code is now in DatabaseBlock. It seems taint-check is now okay with this code, because it is enabled and there is no suppression for that code