This tag is used to group security bugs by their general classification. These bugs cover denial of service (DoS) vulnerabilities.
Parent project: Security-Team
This tag is used to group security bugs by their general classification. These bugs cover denial of service (DoS) vulnerabilities.
Parent project: Security-Team
In T311360#8068029, @Ladsgroup wrote:So if you remove that condition, it should be working again (until I find a fix for it).
This came up today at https://en.wikipedia.org/wiki/User_talk:Anne_drew/SetupAutoArchive#Page_move. It's a bit unintuitive for redirects generated by an official MediaWiki extension to not work. Hopefully the patch in this ticket can continue moving forward.
Just to clarify, despite being disclosed and announced today, Gadgets is a bundled extension, so the fix was released as part of MediaWiki 1.39.8 / 1.40.4 / 1.41.2 / 1.42.1.
Change #1036653 merged by jenkins-bot:
[mediawiki/extensions/Gadgets@REL1_41] SECURITY: Improve regular expression performance
Change #1036654 merged by jenkins-bot:
[mediawiki/extensions/Gadgets@REL1_40] SECURITY: Improve regular expression performance
Change #1036652 merged by jenkins-bot:
[mediawiki/extensions/Gadgets@REL1_42] SECURITY: Improve regular expression performance
Change #1036655 merged by jenkins-bot:
[mediawiki/extensions/Gadgets@REL1_39] SECURITY: Improve regular expression performance
Change #1036655 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/extensions/Gadgets@REL1_39] SECURITY: Improve regular expression performance
Change #1036654 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/extensions/Gadgets@REL1_40] SECURITY: Improve regular expression performance
Change #1036653 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/extensions/Gadgets@REL1_41] SECURITY: Improve regular expression performance
Change #1036652 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/extensions/Gadgets@REL1_42] SECURITY: Improve regular expression performance
Change #1030565 merged by jenkins-bot:
[mediawiki/extensions/Gadgets@master] SECURITY: Improve regular expression performance
Change #1030565 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/extensions/Gadgets@master] SECURITY: Improve regular expression performance
In T363773#9797030, @sbassett wrote:A basic patch implementing @Bawolff's new regexp from above:
01-T363773.patch1 KBDownload
I feel like this is likely low-risk to where it could just go through gerrit since, to exploit this on Wikimedia projects, one would need to first compromise an int-admin account in order to edit MediaWiki:Gadgets-definition.
In T363773#9788169, @R4356th wrote:In T363773#9783948, @mmartorana wrote:If anyone wants to write a patch with @Bawolff enhanced regex to address these issues, we would be pleased to review it and deploy it.
I believe we could move ahead with this, @Bawolff.
Change #1030973 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_39] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030972 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_40] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030884 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_41] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030973 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):
[mediawiki/extensions/CheckUser@REL1_39] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030972 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):
[mediawiki/extensions/CheckUser@REL1_40] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030878 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_42] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030884 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):
[mediawiki/extensions/CheckUser@REL1_41] Skip query in 'Timeline' mode if there are no filtered targets
Change #1030878 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):
[mediawiki/extensions/CheckUser@REL1_42] Skip query in 'Timeline' mode if there are no filtered targets
Change #1026044 abandoned by Dreamy Jazz:
[mediawiki/extensions/CheckUser@REL1_39] Use IndexPager::mLimit for 'Timeline' mode SQL subquery limits
Reason:
Change #1026043 abandoned by Dreamy Jazz:
[mediawiki/extensions/CheckUser@REL1_40] Use IndexPager::mLimit for 'Timeline' mode SQL subquery limits
Reason:
Change #1026042 abandoned by Dreamy Jazz:
[mediawiki/extensions/CheckUser@REL1_41] Use IndexPager::mLimit for 'Timeline' mode SQL subquery limits
Reason:
Change #1026041 abandoned by Dreamy Jazz:
[mediawiki/extensions/CheckUser@REL1_42] Use IndexPager::mLimit for 'Timeline' mode SQL subquery limits
Reason:
Apologies for the late response.
If anyone wants to write a patch with @Bawolff enhanced regex to address these issues, we would be pleased to review it and deploy it.
Above removal done in fc7f21c9 local commit on the server. Re-downgrading and unmarking as a blocker.
Change #1026176 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] Skip query in 'Timeline' mode if there are no filtered targets
I do wonder what the WMF's PCRE backtrack limit is, however.
In T363773#9762681, @Bawolff wrote:A better version that i think is equivalent is:
/^==+ *([^*:\s|]+)\s*(?<!=)==+\s*$/This is still vulnerable according to the redos checker (2nd order poly). However when i tried to actually test it, I wasn't able to really trigger a dos even when giving it 100's of mb of data.
Ah, i guess i was wrong here.
Patch 01-T338419.patch is currently failing to apply for the most recent code in the mainline branch of extensions/CheckUser. This is blocking MediaWiki release 1.43.0-wmf.4(T361398)