Page Menu
Home
WickedGov Phorge
Search
Configure Global Search
Log In
Files
F5979001
Changelog.md
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Flag For Later
Award Token
Size
22 KB
Referenced Files
None
Subscribers
None
Changelog.md
View Options
#
MediaWiki
Security
Check
Plugin
changelog
##
v6
.
0.0
###
Breaking
changes
*
(
MW
)
Most
of
the
taintedness
values
hardcoded
in
MediaWikiSecurityCheckPlugin
::
getCustomFuncTaints
()
have
been
removed
,
and
annotations
have
been
added
to
the
relevant
methods
in
MediaWiki
itself
.
Therefore
,
this
version
of
phan
-
taint
-
check
-
plugin
is
only
compatible
with
MediaWiki
1.41
+.
###
New
features
*
getCustomFuncTaints
implementations
can
now
return
FunctionTaintedness
objects
directly
,
in
addition
to
arrays
.
*
Array
keys
(
and
shapes
in
general
)
are
now
tracked
more
granularly
when
backpropagating
the
effects
of
a
function
call
.
*
(
MW
)
Analyze
the
`
$
rows
`
argument
to
`
Database
::
insert
()
`
more
accurately
,
and
apply
similar
rules
to
`
InsertQueryBuilder
::
row
()
`
and
`
::
rows
()
`
.
*
Improved
shape
inference
for
several
built
-
in
array
functions
.
*
(
MW
)
Treat
the
`
help
`
key
in
HTMLForm
descriptors
as
an
HTML
sink
.
*
(
MW
)
Add
compatibility
for
new
Parser
FQSEN
`
\
MediaWiki
\
Parser
\
Parser
`
.
The
non
-
namespaced
version
is
also
still
supported
.
###
Bug
fixes
*
Fixed
a
bug
where
`
*-
taint
`
annotations
in
an
interface
method
were
only
inherited
by
the
method
implementation
in
children
classes
.
###
Internal
changes
*
Bumped
phan
/
phan
to
5.4
.
3
##
v5
.
0.0
###
Breaking
changes
*
The
raw_param
taint
flag
was
removed
;
error
reporting
is
now
sufficiently
good
that
this
is
no
longer
needed
,
and
can
be
treated
as
normal
exec
.
*
The
taint
type
"misc"
was
removed
.
Use
the
appropriate
category
instead
.
This
type
was
originally
used
for
"rce"
and
"path"
,
so
the
appropriate
replacement
could
be
one
of
those
.
*
The
`
SecurityCheckMulti
`
issue
type
was
removed
.
Now
,
the
plugin
emits
one
issue
per
taint
type
.
*
Dropped
support
for
PHP
7.2
and
7.3
.
###
New
features
*
Added
support
for
the
effects
of
`
unset
(
$
var
[
'k'
]
)
`
on
the
shape
of
`
$
var
`
.
*
The
plugin
now
infers
the
effect
of
some
array_
*
functions
on
the
resulting
taintedness
more
accurately
.
###
Changed
*
The
`
SecurityCheck
-
RCE
`
and
`
SecurityCheck
-
PathTraversal
`
issue
types
now
have
critical
severity
.
###
Internal
changes
*
Bumped
phan
/
phan
to
5.4
.
2
##
v4
.
0.0
###
Breaking
changes
*
Global
variables
and
property
no
longer
have
EXEC
flags
if
they
'
re
later
output
.
Previously
,
it
was
supposed
to
report
assigning
a
tainted
value
to
an
object
that
is
later
output
,
but
didn
'
t
work
due
to
a
bug
.
The
relevant
logic
was
complicating
maintenance
.
Running
phan
with
`
--
analyze
-
twice
`
will
catch
this
kind
of
issues
.
*
The
plugin
no
longer
reanalyzes
classes
when
the
taintedness
of
a
property
is
changed
.
Running
phan
with
`
--
analyze
-
twice
`
will
catch
this
kind
of
issues
.
###
New
features
*
Added
a
new
issue
type
,
`
SecurityCheckInvalidAnnotation
`
,
emitted
for
`
-
taint
`
annotations
that
cannot
be
parsed
,
use
unknown
or
forbidden
values
(
e
.
g
.
EXEC
bits
in
`
return
-
taint
`
),
document
non
-
existing
parameters
,
or
have
redundant
/
missing
`
...
`
.
###
Bug
fixes
*
Caused
-
by
lines
are
now
much
more
accurate
for
code
involving
function
calls
.
###
Internal
changes
*
Bumped
phan
/
phan
to
5.4
.
1
##
v3
.
3.2
###
Bug
fixes
*
Improved
caused
-
by
lines
for
return
statements
consisting
of
a
function
-
like
call
and
for
inherited
methods
.
###
Internal
changes
*
Bumped
phan
/
phan
to
5.2
.
0
##
v3
.
3.1
###
Internal
changes
*
Bumped
phan
/
phan
to
5.1
.
0
##
v3
.
3.0
###
Breaking
changes
*
Removed
support
for
standalone
install
on
MediaWiki
repos
.
Generic
standalone
is
still
supported
,
but
the
script
is
now
called
`
seccheck
`
,
not
`
seccheck
-
generic
`
.
*
`
raw_param
`
is
now
a
modifier
for
EXEC
taintedness
,
so
it
must
be
specified
together
with
EXEC
bits
,
not
normal
bits
.
*
The
plugin
now
limits
reanalysis
of
classes
to
1
per
class
when
the
taintedness
of
a
property
is
changed
.
This
might
hide
some
issues
,
but
is
much
faster
.
Running
phan
with
`
--
analyze
-
twice
`
will
help
;
this
might
become
officially
suggested
in
the
future
.
###
New
features
*
Added
support
for
the
following
PHP
7.4
and
PHP
8
features
:
arrow
functions
,
`
match
`
,
named
arguments
,
nullsafe
method
calls
and
property
access
,
typed
properties
,
constructor
property
promotion
*
Infer
array
shape
mutations
for
several
array
-
related
builtin
functions
*
Improved
taint
data
for
$
_FILES
*
The
plugin
now
properly
infers
when
a
parameter
is
passed
through
by
a
function
(
even
partially
or
conditionally
),
and
can
determine
the
resulting
taintedness
of
a
function
call
much
more
accurately
*
Improved
caused
-
by
lines
for
setters
and
some
functions
that
pass
their
parameters
through
*
It
is
now
possible
to
put
comments
after
`
@
param
-
taint
`
and
`
@
return
-
taint
`
annotations
*
Added
taintedness
data
for
PDO
functions
*
Added
partial
support
for
backpropagating
NUMKEY
taint
,
in
the
very
few
cases
where
false
positives
are
highly
unlikely
(
this
will
be
improved
)
*
(
MW
)
Improved
hook
registration
,
being
now
able
to
infer
the
callback
in
more
cases
*
(
MW
)
Added
partial
support
for
HookHandlers
in
extension
.
json
*
Improved
handling
of
pass
-
by
-
reference
parameters
when
the
parameter
is
essentially
left
unchanged
*
The
plugin
can
now
track
array
shapes
when
backpropagating
EXEC
taintedness
.
This
brings
increased
accuracy
when
analyzing
method
calls
.
*
The
following
hashing
functions
were
annotated
as
removing
taintedness
from
their
arguments
:
`
md5
`
,
`
sha1
`
and
`
crc32
`
###
Bug
fixes
*
Improved
merging
caused
-
by
lines
to
avoid
duplicates
*
Avoid
tracking
dependencies
of
functions
with
hardcoded
taintedness
,
so
to
keep
caused
-
by
lines
shorter
and
more
relevant
*
Fixed
a
bug
that
caused
EXEC
taints
to
be
backpropagated
to
local
variables
,
thus
creating
weird
-
looking
issues
*
Fixed
some
edge
cases
which
would
make
phan
issues
disappear
with
taint
-
check
enabled
###
Internal
changes
*
Bumped
phan
/
phan
to
4.0
.
4
*
The
plugin
now
caches
taintedness
data
inside
AST
nodes
.
This
requires
additional
memory
(
300
MB
for
MW
core
),
but
reduces
the
runtime
(
30
seconds
for
MW
core
)
##
v3
.
2.1
###
Bug
fixes
*
Fixed
a
crash
observed
when
using
the
polyfill
parser
*
Fixed
two
crashes
introduced
with
the
3.2
.
0
release
###
Internal
changes
*
Bumped
phan
/
phan
to
3.2
.
6
##
v3
.
2.0
###
New
features
*
Variadic
parameters
are
now
properly
handled
*
Array
keys
are
now
tracked
separately
from
values
*
(
MW
)
Properly
track
taintedness
of
array
keys
in
some
HTMLForm
specifiers
*
Created
new
taint
types
and
issues
for
RCE
and
path
traversal
:
`
SecurityCheck
-
RCE
`
and
`
SecurityCheck
-
PathTraversal
`
*
Added
detection
for
ReDoS
vulnerabilities
.
New
issue
:
`
SecurityCheck
-
ReDoS
`
*
The
plugin
can
now
properly
analyze
assignments
with
an
array
at
the
LHS
*
Array
shapes
are
now
tracked
more
precisely
when
a
key
that
cannot
be
determined
statically
is
found
##
v3
.
1.1
###
Internal
changes
*
Allow
installing
the
plugin
in
PHP
8
.
Analyzing
code
with
new
PHP
8
features
is
not
supported
yet
(
T269263
)
##
v3
.
1.0
###
New
features
*
Increased
the
length
limit
for
caused
-
by
lines
.
The
new
limit
is
at
12
entries
,
rather
than
fixed
at
255
characters
(
it
was
roughly
doubled
)
*
Caused
-
by
lines
are
now
stored
together
with
a
taintedness
value
,
which
allows
filtering
taintedness
depending
on
the
sink
type
*
Handle
a
few
more
edge
cases
in
foreach
loops
.
Notably
,
class
properties
used
as
key
or
value
are
now
properly
analyzed
,
and
caused
-
by
lines
now
include
sources
of
taintedness
outside
the
loop
.
*
The
plugin
now
filters
taintedness
based
on
the
(
real
)
type
of
variables
using
`
if
`
conditions
,
parameters
and
return
type
declarations
.
*
Binops
are
now
properly
analysed
,
removing
taintedness
if
the
operation
is
safe
.
*
Caused
-
by
lines
for
function
calls
now
include
a
code
snippet
with
the
argument
,
together
with
its
ordinal
.
*
Added
an
annotation
to
print
the
taintedness
of
a
variable
(
use
it
with
`'
@
phan
-
debug
-
var
-
taintedness
$
varname
'`
)
*
Added
taint
data
for
a
bunch
of
built
-
in
functions
###
Bug
fixes
*
(
MW
)
Fixed
a
crash
observed
when
using
`
$
this
`
as
hook
handler
*
Fixed
an
edge
case
that
made
the
plugin
crash
when
attempting
to
use
an
undeclared
variable
as
a
callable
*
Fixed
a
bug
that
caused
the
same
issue
to
be
reported
on
multiple
lines
,
hence
creating
redundant
warnings
,
making
it
difficult
to
suppress
them
all
.
*
(
MW
)
Avoid
crash
when
Hooks
::
run
has
no
arguments
array
*
Fixed
an
edge
case
where
literal
integers
/
strings
weren
'
t
recognized
as
integers
/
strings
;
this
brings
improved
tracking
of
SQL_NUMKEY
.
*
(
MW
)
Fixed
incorrect
taint
data
for
Sanitizer
::
removeHTMLtags
(
T268353
)
*
Slightly
improved
performance
for
recursive
methods
(
analysis
is
not
attempted
,
rather
than
letting
it
reach
the
recursion
limit
of
5
)
###
Internal
changes
*
Taintedness
is
now
stored
in
a
value
object
,
rather
than
a
plain
integer
.
*
Function
taintedness
is
now
stored
in
a
value
object
,
rather
than
an
array
of
integers
.
*
Issue
descriptions
now
use
phan
templates
,
which
notably
adds
support
for
selective
colorizing
.
*
(
MW
)
The
plugin
no
longer
forces
types
for
MW
globals
in
non
-
standalone
mode
.
This
is
now
done
by
mediawiki
-
phan
-
config
.
*
Plugin
classes
were
moved
to
the
`
SecurityCheckPlugin
`
namespace
.
*
Bumped
phan
/
phan
to
3.2
.
4
##
v3
.
0.4
###
New
features
*
Added
explicit
taint
info
for
`
LinkRenderer
::
makeBrokenLink
`
*
Added
explicit
taint
info
for
`
shell_exec
`
and
friends
*
The
plugin
is
now
able
to
properly
analyze
conditionals
,
and
merge
the
possible
taints
of
each
branch
*
The
plugin
can
now
analyze
pass
by
reference
variables
better
*
Added
support
for
analyzing
each
array
element
on
its
own
###
Bug
fixes
*
Fixed
several
plugin
crashes
observed
when
analyzing
weird
syntax
*
Fixed
a
crash
observed
with
non
-
literal
keys
in
getQueryInfo
methods
(
T268055
)
###
Internal
changes
*
Bumped
phan
/
phan
to
3.0
.
3
*
The
plugin
is
now
using
PluginV3
*
Objects
returned
by
methods
are
now
tracked
in
-
place
,
and
`
GetReturnObjVisitor
`
was
deleted
##
v3
.
0.3
*
Remove
reference
to
`
AST_LIST
`
(
Daimona
Eaytoy
)
*
Avoid
shelling
out
to
run
tests
(
Daimona
Eaytoy
)
*
Move
hooks
-
related
methods
to
a
new
class
(
Daimona
Eaytoy
)
*
composer
:
Add
Daimona
as
an
author
(
James
D
.
Forrester
)
*
Split
a
long
method
(
Daimona
Eaytoy
)
*
Expand
docs
for
"manual"
mode
(
Daimona
Eaytoy
)
*
Assert
that
the
config
options
we
need
are
enabled
(
Daimona
Eaytoy
)
*
Avoid
conflating
`
stdClass
`
instances
(
Daimona
Eaytoy
)
*
Cleanup
:
Various
improvements
suggested
by
PHPStorm
(
Daimona
Eaytoy
)
*
Cleanup
:
Add
return
type
hints
where
applicable
(
Daimona
Eaytoy
)
*
Exclude
invalid
PHP
files
from
analysis
(
Daimona
Eaytoy
)
##
v3
.
0.2
*
Fix
`
PhanTypeComparisonFromArray
`
edge
cases
(
Daimona
Eaytoy
)
*
Don
'
t
check
type
validity
in
`
nodeIs
(
String
|
Int
)
`
(
Daimona
Eaytoy
)
*
Optim
:
Don
'
t
reanalyze
functions
if
we
already
have
data
(
Daimona
Eaytoy
)
*
Fix
edge
cases
with
`
getOriginalScope
`
(
Daimona
Eaytoy
)
*
Make
`
handleMethodCall
`
always
require
a
`
FunctionInterface
`
and
a
function
FQSEN
(
Daimona
Eaytoy
)
*
Fix
bad
interaction
with
phan
,
part
3
(
Daimona
Eaytoy
)
*
Cleanup
:
Remove
unnecessary
`
try
/
catch
`
constructs
(
Daimona
Eaytoy
)
*
Cleanup
:
Add
method
to
extract
data
from
exceptions
(
Daimona
Eaytoy
)
*
Cleanup
:
Change
`
taintToIssueAndSeverity
`
to
use
a
switch
(
Daimona
Eaytoy
)
*
Fix
another
edge
case
interaction
with
phan
(
Daimona
Eaytoy
)
*
Fix
edge
case
with
prop
access
confusing
other
parts
of
phan
(
Daimona
Eaytoy
)
##
v3
.
0.1
*
build
:
Upgrade
minus
-
x
from
0.3
.
2
to
1.1
.
0
(
James
D
.
Forrester
)
*
Upgrade
phan
to
latest
version
(
Daimona
Eaytoy
)
*
Properly
handle
`
list
()
`
assignments
(
Daimona
Eaytoy
)
*
Upgrade
phan
to
2.4
.
0
(
Daimona
Eaytoy
)
##
v3
.
0.0
*
Fix
phan
crash
when
analyzing
MediaWiki
core
(
Daimona
Eaytoy
)
*
Add
`
RAW_PARAM
`
taint
type
(
Daimona
Eaytoy
)
*
build
:
Upgrade
mediawiki
-
codesniffer
from
v29
.
0.0
to
v30
.
0.0
(
James
D
.
Forrester
)
*
Remove
outdated
config
settings
(
Daimona
Eaytoy
)
*
Add
`
UnusedSuppressionPlugin
`
limited
to
our
warnings
(
Daimona
Eaytoy
)
*
Actually
handle
binary
addition
(
Daimona
Eaytoy
)
*
Update
PHPUnit
to
8.5
(
Umherirrender
)
*
build
:
Upgrade
mediawiki
-
codesniffer
to
v29
.
0.0
(
James
D
.
Forrester
)
*
build
:
Updating
composer
dependencies
(
Umherirrender
)
*
Upgrade
phan
to
2.2
.
13
(
Daimona
Eaytoy
)
*
Remove
hack
for
OOUI
constructors
(
Daimona
Eaytoy
)
*
Upgrade
to
phan
2.2
.
5
(
Daimona
Eaytoy
)
*
Further
improvements
for
same
var
reassignments
(
Daimona
Eaytoy
)
*
Better
handling
of
reassignments
of
the
same
var
(
Daimona
Eaytoy
)
*
Don
'
t
fail
hard
when
core
methods
cannot
be
found
(
Daimona
Eaytoy
)
*
Shrink
config
files
even
more
(
Daimona
Eaytoy
)
*
Remove
explicit
dependency
on
`
ext
-
ast
`
(
Daimona
Eaytoy
)
*
Cleanup
parent
var
linking
code
(
Daimona
Eaytoy
)
*
Remove
awful
hack
for
var
context
(
Daimona
Eaytoy
)
*
Upgrade
to
PHPUnit
8.4
(
Daimona
Eaytoy
)
*
build
:
Upgrade
MW
phpcs
to
28.0
.
0
(
Daimona
Eaytoy
)
*
Replace
`
EXEC_TAINT
`
with
`
ALL_EXEC_TAINT
`
where
latter
was
meant
(
Brian
Wolff
)
*
Upgrade
phan
to
2.0
.
0
,
ast
to
1.0
.
1
and
require
PHP72
+
(
Daimona
Eaytoy
)
##
v2
.
1.0
*
Improve
caused
-
by
lines
(
Daimona
Eaytoy
)
*
Add
debug
for
reaching
max
analysis
depth
(
Daimona
Eaytoy
)
*
Add
some
unhandled
node
kinds
(
Daimona
Eaytoy
)
*
Visit
`
AST_EMPTY
`
(
Daimona
Eaytoy
)
*
Further
improvements
(
Daimona
Eaytoy
)
*
Handle
closure
vars
(
Daimona
Eaytoy
)
*
Handle
closures
(
Daimona
Eaytoy
)
*
Make
CI
run
phpunit
tests
(
Daimona
Eaytoy
)
*
Make
CI
run
phpunit
tests
(
Daimona
Eaytoy
)
##
v2
.
0.2
*
Fix
a
crash
with
the
literal
'`
class
`'
(
Daimona
Eaytoy
)
*
Handle
pre
/
post
-
increment
/
decrement
operators
(
Daimona
Eaytoy
)
*
Various
code
quality
improvements
(
Daimona
Eaytoy
)
*
Restore
`
TypedElementInterface
`
typehints
(
Daimona
Eaytoy
)
*
Fix
some
FIXMEs
(
Daimona
Eaytoy
)
*
Fix
some
issues
with
CI
(
Daimona
Eaytoy
)
*
Add
missing
slashes
to
`
MW_INSTALL_PATH
`
(
Daimona
Eaytoy
)
*
Re
-
fix
failing
test
(
Daimona
Eaytoy
)
*
Fix
a
failing
test
(
Daimona
Eaytoy
)
##
v2
.
0.1
*
Fix
some
issues
with
CI
(
Daimona
Eaytoy
)
*
Add
missing
slashes
to
`
MW_INSTALL_PATH
`
(
Daimona
Eaytoy
)
*
Re
-
fix
failing
test
(
Daimona
Eaytoy
)
*
Fix
a
failing
test
(
Daimona
Eaytoy
)
*
Remove
a
duplicated
method
(
Daimona
Eaytoy
)
*
When
suppressing
a
warning
,
also
suppress
side
effects
(
Brian
Wolff
)
*
Mark
`
IDatabase
::
buildLike
`
as
something
that
escapes
SQL
(
Brian
Wolff
)
*
Special
handling
for
`
Linker
::
makeExternalLink
`
(
Brian
Wolff
)
*
When
in
MW
mode
,
consider
XSS
in
the
maintenance
directory
to
be
false
positives
(
Brian
Wolff
)
*
Prevent
an
`
EXEC
`
variable
from
tainting
itself
(
Brian
Wolff
)
##
v2
.
0.0
*
Remove
wrong
`
EXEC
`
bits
from
MW
functions
(
Daimona
Eaytoy
)
*
Take
into
account
implicit
BranchScopes
(
Daimona
Eaytoy
)
*
Update
readme
(
Daimona
Eaytoy
)
*
Add
a
file
with
base
config
(
Daimona
Eaytoy
)
*
Temporarily
lower
ast
requirement
(
Daimona
Eaytoy
)
*
Hotfix
for
OOUI
exclusion
(
Daimona
Eaytoy
)
*
Handle
nested
calls
(
Daimona
Eaytoy
)
*
Set
taintedness
to
`
NO_TAINT
`
for
`
class
-
string
`
and
`
callable
-
string
`
(
Daimona
Eaytoy
)
*
Update
integration
tests
(
Daimona
Eaytoy
)
*
Fix
global
variable
handling
(
Daimona
Eaytoy
)
*
Add
checks
for
`
ClosureType
`
(
Daimona
Eaytoy
)
*
Transfer
the
taintedness
from
objects
to
props
(
Daimona
Eaytoy
)
*
Prevent
class
props
from
sending
taintedness
too
far
(
Daimona
Eaytoy
)
*
Restore
code
bit
for
linking
var
to
parentvar
(
Daimona
Eaytoy
)
*
Make
`
nodeIsString
`
work
again
(
Daimona
Eaytoy
)
*
Unbreak
`
passByReference
`
parameters
handling
(
Daimona
Eaytoy
)
*
Hack
:
exclude
OOUI
constructors
from
DoubleEscape
reporting
(
Daimona
Eaytoy
)
*
Unbreak
handling
of
`
$
argc
`
and
`
$
argv
`
(
Daimona
Eaytoy
)
*
Unbreak
docblock
parsing
(
Daimona
Eaytoy
)
*
Fix
phan
issues
(
Daimona
Eaytoy
)
*
Upgrade
phan
to
1.3
.
2
and
php
-
ast
to
1.0
.
1
(
Daimona
Eaytoy
)
*
When
suppressing
a
warning
,
also
suppress
side
effects
(
Brian
Wolff
)
*
Mark
`
IDatabase
::
buildLike
`
as
something
that
escapes
SQL
(
Brian
Wolff
)
*
Special
handling
for
`
Linker
::
makeExternalLink
`
(
Brian
Wolff
)
*
When
in
MW
mode
,
consider
XSS
in
the
maintenance
directory
to
be
false
positives
(
Brian
Wolff
)
*
Prevent
an
`
EXEC
`
variable
from
tainting
itself
(
Brian
Wolff
)
*
Upgrade
phan
to
1.2
.
6
(
Daimona
Eaytoy
)
*
Minor
fixes
(
Daimona
Eaytoy
)
*
Upgrade
phan
to
1.0
.
0
(
Daimona
Eaytoy
)
*
Upgrade
to
PluginV2
(
Daimona
Eaytoy
)
*
Turn
`
TaintednessBaseVisitor
`
into
a
trait
(
Daimona
Eaytoy
)
*
Change
inheritance
for
MW
analyzer
(
Daimona
Eaytoy
)
*
Upgrade
phan
to
0.9
.
6
(
Daimona
Eaytoy
)
*
Upgrade
phan
to
0.8
.
13
(
Daimona
Eaytoy
)
*
Move
regression
test
to
PHPUnit
(
Daimona
Eaytoy
)
*
Upgrade
phan
to
0.8
.
6
(
Daimona
Eaytoy
)
*
Minor
fixes
(
Daimona
Eaytoy
)
*
Remove
phpcs
bootstrap
.
(
Brian
Wolff
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
24.0
.
0
(
libraryupgrader
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
23.0
.
0
(
libraryupgrader
)
*
Add
another
test
case
related
to
batch
insert
.
(
Brian
Wolff
)
##
v1
.
5.1
*
Fix
fatal
when
using
global
keyword
with
indirect
variable
(
Brian
Wolff
)
*
Clarify
`
SECURITY_CHECK_EXT_PATH
`
documentation
(
Kunal
Mehta
)
##
v1
.
5.0
*
Avoid
false
positive
related
to
`
getQueryInfo
()
`
methods
.
(
Brian
Wolff
)
*
Include
syntax
errors
in
the
output
of
plugin
.
(
Brian
Wolff
)
*
Fix
a
fatal
during
a
misdetected
`
HTMLForm
`
specifier
with
empty
class
(
Brian
Wolff
)
*
Fix
IN
list
case
for
db
conds
when
doing
`
$
conds
[
'
field
'
][]
=
$
tainted
`
(
Brian
Wolff
)
*
Fix
some
confusion
over
which
group
of
taints
to
mask
out
in
various
places
(
Brian
Wolff
)
*
Treat
`
htmlform
type
=
info
`'
s
'
rawrow
'
option
like
'
raw
'
(
Brian
Wolff
)
*
Disable
`
htmlform
`
detection
inside
`
AuthenticationRequest
`
(
Brian
Wolff
)
*
Better
handling
of
`
HTMLForm
$
options
`
(
Brian
Wolff
)
*
Support
custom
checking
for
`
IDatabase
::
makeList
`
(
Brian
Wolff
)
*
Update
README
expand
limitation
section
(
Brian
Wolff
)
*
Link
to
docker
image
instructions
in
README
.
md
(
Brian
Wolff
)
*
Make
parser
hooks
work
properly
even
without
type
hints
(
Brian
Wolff
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
22.0
.
0
(
libraryupgrader
)
*
Fix
bug
in
how
taint
propagation
works
(
Brian
Wolff
)
##
v1
.
4.0
*
Make
`
seccheck
-
mwext
`
and
`
seccheck
-
fast
-
mwext
`
work
with
skins
(
Brian
Wolff
)
*
Make
`
onlysafefor_html
`
not
mark
things
as
`
exec_escaped
`
.
(
Brian
Wolff
)
*
Mark
`
base64_encode
`
as
escaping
taint
.
(
Brian
Wolff
)
*
Fix
error
in
argument
handling
in
test
script
(
Brian
Wolff
)
*
Add
an
indirect
test
case
to
taghook
test
(
Brian
Wolff
)
*
Move
builtin
taints
for
`
Parser
`
&
`
ParserOutput
`
into
inline
annotations
(
Brian
Wolff
)
*
Prevent
`
NO_OVERRIDE
`
flag
from
being
propagated
during
assignment
(
Brian
Wolff
)
*
Add
support
for
reading
skin
.
json
in
addition
to
extension
.
json
(
Brian
Wolff
)
##
v1
.
3.1
*
Ignore
tests
/
in
mwext
-
fast
(
Kunal
Mehta
)
*
Fix
markdown
syntax
in
README
(
Umherirrender
)
##
v1
.
3.0
*
Refactor
docblock
taint
annotation
to
support
docblocks
on
interfaces
(
Brian
Wolff
)
*
Improve
tracking
of
outputting
class
members
(
Brian
Wolff
)
*
Standardize
casing
in
error
as
"Calling method..."
(
method
is
lowercase
)
(
Kunal
Mehta
)
*
Fix
bug
when
argument
both
normal
taint
and
execute
taint
(
Brian
Wolff
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
21.0
.
0
(
libraryupgrader
)
*
Fix
bug
where
pass
by
ref
causing
func
to
be
treated
as
unknown
(
Brian
Wolff
)
*
rm
the
hardcoded
OOUI
taints
.
They
were
wrong
.
(
Brian
Wolff
)
*
Add
code
to
force
type
for
MW
globals
(
Brian
Wolff
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
20.0
.
0
(
libraryupgrader
)
##
v1
.
2.0
*
Add
support
for
docblock
taint
annotations
(
Brian
Wolff
)
*
Fix
phan
tests
(
Brian
Wolff
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
18.0
.
0
(
libraryupgrader
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
17.0
.
0
(
libraryupgrader
)
*
build
:
Updating
jakub
-
onderka
/
php
-
parallel
-
lint
to
1.0
.
0
(
libraryupgrader
)
*
Add
support
for
checking
`
HTMLForm
`
specifiers
(
Brian
Wolff
)
*
Use
SPDX
3.0
license
identifier
(
Umherirrender
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
16.0
.
1
(
libraryupgrader
)
*
build
:
Adding
MinusX
(
Umherirrender
)
*
Don
'
t
mark
`
\
Xml
::
encodeJsVar
`
and
`
encodeJsCall
`
as
double
escaping
(
Brian
Wolff
)
*
Fix
missing
initial
`
\
`
in
class
name
list
(
Brian
Wolff
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
16.0
.
0
(
libraryupgrader
)
*
Add
support
for
looking
at
`
__toString
()
`
when
object
in
string
context
(
Brian
Wolff
)
*
Improve
some
of
the
double
escaping
checks
.
(
Brian
Wolff
)
*
Depend
upon
phan
/
phan
instead
of
deprecated
etsy
/
phan
(
Kunal
Mehta
)
*
build
:
Updating
mediawiki
/
mediawiki
-
codesniffer
to
15.0
.
0
(
Kunal
Mehta
)
*
Add
`
Hooks
::
runWithoutAbort
`
support
(
Phantom42
)
*
Add
double
escaping
detection
(
Albert221
)
*
Appearently
this
doesn
'
t
work
with
php
-
ast
0.1
.
5
(
Brian
Wolff
)
##
v1
.
1.0
*
Html
escaping
functions
shouldn
'
t
clear
non
-
html
taint
(
Brian
Wolff
)
*
Finish
rename
to
mediawiki
/
phan
-
taint
-
check
-
plugin
(
Brian
Wolff
)
*
Add
.
gitattributes
file
(
Brian
Wolff
)
*
Fix
some
typos
(
Kunal
Mehta
)
*
Fix
indentation
in
.
phpcs
.
xml
(
Kunal
Mehta
)
*
Replace
`
SecurityCheckPlugin
::
`
with
`
self
::
`
where
possible
(
Brian
Wolff
)
*
Add
a
test
script
for
people
whose
php
bin
is
not
7
(
Brian
Wolff
)
*
Disable
progress
bar
in
composer
test
,
as
ugly
on
jenkins
(
Brian
Wolff
)
*
Rename
plugin
to
mediawiki
/
phan
-
taint
-
check
-
plugin
(
Brian
Wolff
)
*
Add
a
note
about
how
it
can
'
t
validate
certain
types
of
SQL
(
Brian
Wolff
)
*
Version
should
be
php
7.0
(
7.1
not
supported
due
to
dependency
)
(
Brian
Wolff
)
*
Rename
to
"mediawiki/phan-security-plugin"
(
Kunal
Mehta
)
*
Fix
test
that
didn
'
t
pass
lint
(
Brian
Wolff
)
*
Follow
-
up
on
Ie9106c80
(
MarcoAurelio
)
*
build
:
update
composer
.
json
(
MarcoAurelio
)
*
Add
.
gitreview
(
MarcoAurelio
)
*
Add
GPL
license
headers
(
Brian
Wolff
)
*
Make
README
prettier
(
Bryan
Davis
)
##
v1
.
0.0
*
Update
composer
.
json
(
Brian
Wolff
)
*
Support
installing
via
composer
.
(
Brian
Wolff
)
*
Update
README
(
Brian
Wolff
)
*
Move
plugin
entry
points
to
root
directory
(
Brian
Wolff
)
*
Fix
some
false
positives
discovered
while
testing
with
MW
(
Brian
Wolff
)
*
Fix
various
false
positives
found
when
testing
with
MW
(
Brian
Wolff
)
*
Add
a
test
for
`
list
()
`
support
(
Brian
Wolff
)
*
Add
test
for
array
addition
with
`
SQL_NUMKEY
`
(
Brian
Wolff
)
*
Minor
fixes
discovered
during
testing
(
Brian
Wolff
)
*
Ensure
that
errors
related
to
function
are
per
param
(
Brian
Wolff
)
*
Minor
fixes
to
the
eval
case
(
Brian
Wolff
)
*
Some
debugging
fixes
(
Brian
Wolff
)
*
Support
checking
`
getQueryInfo
()
`
return
;
Process
`
$
options
`
&
`
$
join_conds
`
(
Brian
Wolff
)
*
Fix
handling
of
`
IN
(...)
`
lists
in
db
`
select
`
wrapper
(
Brian
Wolff
)
*
Add
support
for
`
IDatabase
::
select
`
style
arguments
(
Brian
Wolff
)
*
Fix
bug
where
non
-
local
variables
are
treated
like
local
(
Brian
Wolff
)
*
Add
`
ARRAY_OK
`
flag
for
functions
that
are
safe
with
arrays
(
Brian
Wolff
)
*
Make
unit
tests
for
extension
.
json
always
work
(
Brian
Wolff
)
*
Make
error
messages
from
hooks
be
in
extension
instead
of
core
(
Brian
Wolff
)
*
Avoid
duplication
in
output
(
Brian
Wolff
)
*
Fix
some
minor
issues
(
Brian
Wolff
)
*
Handle
dispatching
of
hooks
on
`
Hooks
::
run
()
`
(
Brian
Wolff
)
*
Support
loading
hook
information
from
extension
.
json
(
Brian
Wolff
)
*
Make
more
clear
error
messages
,
distinguishing
different
issue
types
(
Brian
Wolff
)
*
Support
recognizing
`
$
wgHooks
/$
_GLOBALS
[
'
wgHooks
'
]
`
(
Brian
Wolff
)
*
Keep
track
of
hook
registrations
(
Brian
Wolff
)
*
Add
support
for
parser
tag
hooks
(
Brian
Wolff
)
*
Support
`
ParserFunctions
`
,
and
start
of
work
for
hooks
in
general
(
Brian
Wolff
)
*
Add
taint
for
db
related
function
.
Fix
handling
of
subclasses
(
Brian
Wolff
)
*
Mention
phan
version
requirements
(
Brian
Wolff
)
*
Fix
remaining
tests
(
mostly
phpcs
)
(
Brian
Wolff
)
*
Fix
various
tests
(
Brian
Wolff
)
*
Add
composer
and
phpcs
.
(
Brian
Wolff
)
*
Use
the
normal
GPL
v2
(
Kunal
Mehta
)
*
Do
not
ouput
very
noisy
debug
by
default
(
Brian
Wolff
)
*
Initial
commit
.
(
Brian
Wolff
)
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Sat, Oct 3, 20:41 (4 d, 6 h ago)
Storage Engine
local-disk
Storage Format
Raw Data
Storage Handle
17/fd/26fbe0ac181d4ae3e7be1e9d02ec
Default Alt Text
Changelog.md (22 KB)
Attached To
Mode
rMWPROD MediaWiki Production
Attached
Detach File
Event Timeline
Log In to Comment