[go: up one dir, main page]

Page MenuHomePhabricator

HTMLForm's validation-callback is given mixed values
Open, Needs TriagePublicBUG REPORT

Description

The HTMLFormField::validate() method is documented to accept string|array for the $value, but actually any valid user preference value can be passed, including null and int.

This passes through to form field definitions that use the 'validation-callback' key, where that callback is also expecting to get an input value in the same type as the form field being defined. This is a reasonable assumption in most cases (i.e. a text type is going to be given a string), but it can also be given null.

This bug surfaces in the case of DefaultPreferencesFactory::validateSignature() which is expecting a string and breaks in PHP 8.1 with null, which it passes to mb_strlen():

Deprecated: mb_strlen(): Passing null to parameter #1 ($string) of type string is deprecated in mediawiki/includes/preferences/DefaultPreferencesFactory.php on line 1711

MediaWiki version: 5c5d593c7cb2133866b266ec2c4407e5a77e0ef3

Event Timeline

Change 833886 had a related patch set uploaded (by Samwilson; author: Samwilson):

[mediawiki/core@master] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/833886

Change 833886 merged by jenkins-bot:

[mediawiki/core@master] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/833886

Change 834667 had a related patch set uploaded (by Reedy; author: Samwilson):

[mediawiki/core@REL1_39] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834667

Change 834668 had a related patch set uploaded (by Reedy; author: Samwilson):

[mediawiki/core@REL1_38] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834668

Change 834669 had a related patch set uploaded (by Reedy; author: Samwilson):

[mediawiki/core@REL1_37] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834669

Change 834670 had a related patch set uploaded (by Reedy; author: Samwilson):

[mediawiki/core@REL1_35] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834670

Change 834670 abandoned by Reedy:

[mediawiki/core@REL1_35] Update docs for HTMLFormField::validate() to permit all data types

Reason:

https://gerrit.wikimedia.org/r/834670

Change 834669 merged by jenkins-bot:

[mediawiki/core@REL1_37] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834669

Change 834667 merged by jenkins-bot:

[mediawiki/core@REL1_39] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834667

Change 834668 merged by Reedy:

[mediawiki/core@REL1_38] Update docs for HTMLFormField::validate() to permit all data types

https://gerrit.wikimedia.org/r/834668