Merge "build: Update mediawiki/mediawiki-phan-config to 0.12.0"

composer.json

@@ -88,7 +88,7 @@
 		"hamcrest/hamcrest-php": "^2.0",
 		"johnkary/phpunit-speedtrap": "^4.0",
 		"mediawiki/mediawiki-codesniffer": "39.0.0",
-		"mediawiki/mediawiki-phan-config": "0.11.1",
+		"mediawiki/mediawiki-phan-config": "0.12.0",
 		"nikic/php-parser": "^4.10.2",
 		"php-parallel-lint/php-console-highlighter": "1.0.0",
 		"php-parallel-lint/php-parallel-lint": "1.3.2",

includes/GlobalFunctions.php

@@ -1938,7 +1938,6 @@ function wfGetDB( $db, $groups = [], $wiki = false ) {
 function wfScript( $script = 'index' ) {
 	global $wgScriptPath, $wgScript, $wgLoadScript;
 	if ( $script === 'index' ) {
-		// @phan-suppress-next-line PhanPossiblyUndeclaredVariable False positive
 		return $wgScript;
 	} elseif ( $script === 'load' ) {
 		return $wgLoadScript;

includes/OutputPage.php

@@ -3118,6 +3118,7 @@ class OutputPage extends ContextSource {
 			$text .= '</ul>';
 		} else {
 			$text .= "<div class=\"permissions-errors\">\n" .
+					// @phan-suppress-next-line PhanParamTooFewUnpack Elements of $errors already annotated as non-empty
 					$this->msg( ...reset( $errors ) )->plain() .
 					"\n</div>";
 		}

includes/Rest/Handler/ParsoidHandler.php

@@ -794,7 +794,10 @@ abstract class ParsoidHandler extends Handler {
 				ParsoidFormatHelper::setContentType( $response, ParsoidFormatHelper::FORMAT_HTML,
 					$attribs['envOptions']['outputContentVersion'] );
 				$response->getBody()->write( $out );
+				// @phan-suppress-next-next-line PhanTypeArraySuspiciousNullable $headers can't be null after the
+				// method call, but the docblock of wikitext2html doesn't say that.
 				$response->setHeader( 'Content-Language', $headers['content-language'] );
+				// @phan-suppress-next-line PhanTypeArraySuspiciousNullable Same.
 				$response->addHeader( 'Vary', $headers['vary'] );
 			}
 

includes/Title.php

@@ -804,7 +804,6 @@ class Title implements LinkTarget, PageIdentity, IDBAccessObject {
 				$r0 = $d0;
 			}
 			// Do the output
-			// @phan-suppress-next-line PhanPluginRedundantAssignmentInLoop Confusing, $r1 is set later
 			if ( $x0 !== '' && $x1 === '-' && $x2 !== '' ) {
 				// Range
 				if ( $ord2 > $ord0 ) {
@@ -821,6 +820,7 @@ class Title implements LinkTarget, PageIdentity, IDBAccessObject {
 					$out .= "$r2-$r0";
 				}
 				// Reset state to the initial value
+				// @phan-suppress-next-line PhanPluginRedundantAssignmentInLoop
 				$x0 = $x1 = $d0 = $d1 = $r0 = $r1 = '';
 			} elseif ( $ord2 < 0x80 ) {
 				// ASCII character
@@ -2271,7 +2271,6 @@ class Title implements LinkTarget, PageIdentity, IDBAccessObject {
 				$url = false;
 				$matches = [];
 
-				// @phan-suppress-next-line PhanPossiblyUndeclaredVariable False positive
 				$articlePaths = PathRouter::getActionPaths( $wgActionPaths, $wgArticlePath );
 
 				if ( $articlePaths
@@ -2310,7 +2309,6 @@ class Title implements LinkTarget, PageIdentity, IDBAccessObject {
 					if ( $query == '-' ) {
 						$query = '';
 					}
-					// @phan-suppress-next-line PhanPossiblyUndeclaredVariable False positive
 					$url = "{$wgScript}?title={$dbkey}&{$query}";
 				}
 			}
@@ -2340,7 +2338,6 @@ class Title implements LinkTarget, PageIdentity, IDBAccessObject {
 	 */
 	public function getLinkURL( $query = '', $query2 = false, $proto = false ) {
 		if ( $this->isExternal() || $proto !== false ) {
-			// @phan-suppress-next-line PhanTypeMismatchArgument
 			$ret = $this->getFullURL( $query, $query2, $proto );
 		} elseif ( $this->getPrefixedText() === '' && $this->hasFragment() ) {
 			$ret = $this->getFragmentForURL();

includes/WebRequest.php

@@ -166,7 +166,6 @@ class WebRequest {
 			$path = $a['path'] ?? '';
 
 			global $wgScript;
-			// @phan-suppress-next-line PhanPossiblyUndeclaredVariable False positive
 			if ( $path == $wgScript && $want !== 'all' ) {
 				// Script inside a rewrite path?
 				// Abort to keep from breaking...
@@ -176,7 +175,6 @@ class WebRequest {
 			$router = new PathRouter;
 
 			// Raw PATH_INFO style
-			// @phan-suppress-next-line PhanPossiblyUndeclaredVariable False positive
 			$router->add( "$wgScript/$1" );
 
 			global $wgArticlePath;

includes/api/ApiBase.php

@@ -1465,7 +1465,6 @@ abstract class ApiBase extends ContextSource {
 	 * @return never
 	 */
 	public function dieWithException( Throwable $exception, array $options = [] ) {
-		// @phan-suppress-previous-line PhanTypeMissingReturn
 		$this->dieWithError(
 			// @phan-suppress-next-line PhanTypeMismatchArgument
 			$this->getErrorFormatter()->getMessageFromException( $exception, $options )
@@ -1482,7 +1481,6 @@ abstract class ApiBase extends ContextSource {
 	 * @return never
 	 */
 	public function dieBlocked( Block $block ) {
-		// @phan-suppress-previous-line PhanTypeMissingReturn
 		// Die using the appropriate message depending on block type
 		if ( $block->getType() == Block::TYPE_AUTO ) {
 			$this->dieWithError(
@@ -1544,7 +1542,6 @@ abstract class ApiBase extends ContextSource {
 	 * @return never
 	 */
 	public function dieReadOnly() {
-		// @phan-suppress-previous-line PhanTypeMissingReturn
 		$this->dieWithError(
 			'apierror-readonly',
 			'readonly',

includes/api/ApiEditPage.php

@@ -621,6 +621,7 @@ class ApiEditPage extends ApiBase {
 						// errors on the status.
 						// @codeCoverageIgnoreStart
 						case EditPage::AS_SPAM_ERROR:
+							// @phan-suppress-next-line PhanTypePossiblyInvalidDimOffset
 							$status->fatal( 'apierror-spamdetected', $result['spam'] );
 							break;
 						case EditPage::AS_READ_ONLY_PAGE_LOGGED:

includes/api/ApiExpandTemplates.php

@@ -119,6 +119,7 @@ class ApiExpandTemplates extends ApiBase {
 		if ( isset( $prop['parsetree'] ) || $params['generatexml'] ) {
 			$this->parser->startExternalParse( $titleObj, $options, Parser::OT_PREPROCESS );
 			$dom = $this->parser->preprocessToDom( $params['text'] );
+			// @phan-suppress-next-line PhanUndeclaredMethodInCallable
 			if ( is_callable( [ $dom, 'saveXML' ] ) ) {
 				// @phan-suppress-next-line PhanUndeclaredMethod
 				$xml = $dom->saveXML();

includes/api/ApiQueryRevisionsBase.php

@@ -580,6 +580,7 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase {
 					Parser::OT_PREPROCESS
 				);
 				$dom = $parser->preprocessToDom( $t );
+				// @phan-suppress-next-line PhanUndeclaredMethodInCallable
 				if ( is_callable( [ $dom, 'saveXML' ] ) ) {
 					// @phan-suppress-next-line PhanUndeclaredMethod
 					$xml = $dom->saveXML();

includes/api/ApiUpload.php

@@ -414,7 +414,6 @@ class ApiUpload extends ApiBase {
 	 * @return never
 	 */
 	private function dieRecoverableError( $errors, $parameter = null ) {
-		// @phan-suppress-previous-line PhanTypeMissingReturn
 		$this->performStash( 'optional', $data );
 
 		if ( $parameter ) {
@@ -441,7 +440,6 @@ class ApiUpload extends ApiBase {
 	 * @return never
 	 */
 	public function dieStatusWithCode( $status, $overrideCode, $moreExtraData = null ) {
-		// @phan-suppress-previous-line PhanTypeMissingReturn
 		$sv = StatusValue::newGood();
 		foreach ( $status->getErrors() as $error ) {
 			$msg = ApiMessage::create( $error, $overrideCode );
@@ -654,7 +652,6 @@ class ApiUpload extends ApiBase {
 	 * @return never
 	 */
 	protected function checkVerification( array $verification ) {
-		// @phan-suppress-previous-line PhanTypeMissingReturn
 		switch ( $verification['status'] ) {
 			// Recoverable errors
 			case UploadBase::MIN_LENGTH_PARTNAME:

includes/auth/ButtonAuthenticationRequest.php

@@ -103,6 +103,7 @@ class ButtonAuthenticationRequest extends AuthenticationRequest {
 		} elseif ( is_string( $data['label'] ) ) {
 			$data['label'] = new Message( $data['label'] );
 		} elseif ( is_array( $data['label'] ) && $data['label'] ) {
+			// @phan-suppress-next-line PhanParamTooFewUnpack Should infer non-emptiness from above
 			$data['label'] = Message::newFromKey( ...$data['label'] );
 		}
 		if ( !isset( $data['help'] ) ) {
@@ -110,6 +111,7 @@ class ButtonAuthenticationRequest extends AuthenticationRequest {
 		} elseif ( is_string( $data['help'] ) ) {
 			$data['help'] = new Message( $data['help'] );
 		} elseif ( is_array( $data['help'] ) && $data['help'] ) {
+			// @phan-suppress-next-line PhanParamTooFewUnpack Should infer non-emptiness from above
 			$data['help'] = Message::newFromKey( ...$data['help'] );
 		}
 		$ret = new static( $data['name'], $data['label'], $data['help'] );

includes/block/BlockManager.php

@@ -195,7 +195,6 @@ class BlockManager {
 		} elseif ( count( $blocks ) === 1 ) {
 			return $blocks[ 0 ];
 		} else {
-			// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 			return new CompositeBlock( [
 				'address' => $ip,
 				'reason' => new Message( 'blockedtext-composite-reason' ),
@@ -253,14 +252,12 @@ class BlockManager {
 		if ( !in_array( $ip, $this->options->get( MainConfigNames::ProxyWhitelist ) ) ) {
 			// Local list
 			if ( $this->isLocallyBlockedProxy( $ip ) ) {
-				// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 				$blocks[] = new SystemBlock( [
 					'reason' => new Message( 'proxyblockreason' ),
 					'address' => $ip,
 					'systemBlock' => 'proxy',
 				] );
 			} elseif ( $isAnon && $this->isDnsBlacklisted( $ip ) ) {
-				// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 				$blocks[] = new SystemBlock( [
 					'reason' => new Message( 'sorbsreason' ),
 					'address' => $ip,
@@ -272,7 +269,6 @@ class BlockManager {
 
 		// Soft blocking
 		if ( $isAnon && IPUtils::isInRanges( $ip, $this->options->get( MainConfigNames::SoftBlockRanges ) ) ) {
-			// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 			$blocks[] = new SystemBlock( [
 				'address' => $ip,
 				'reason' => new Message( 'softblockrangesreason', [ $ip ] ),

includes/block/DatabaseBlock.php

@@ -266,7 +266,6 @@ class DatabaseBlock extends AbstractBlock {
 					$conds['ipb_address'][] = (string)$target;
 					$conds['ipb_address'] = array_unique( $conds['ipb_address'] );
 					$conds[] = self::getRangeCond( IPUtils::toHex( $target ) );
-					// @phan-suppress-next-line SecurityCheck-SQLInjection
 					$conds = $db->makeList( $conds, LIST_OR );
 					break;
 
@@ -274,7 +273,6 @@ class DatabaseBlock extends AbstractBlock {
 					list( $start, $end ) = IPUtils::parseRange( $target );
 					$conds['ipb_address'][] = (string)$target;
 					$conds[] = self::getRangeCond( $start, $end );
-					// @phan-suppress-next-line SecurityCheck-SQLInjection
 					$conds = $db->makeList( $conds, LIST_OR );
 					break;
 
@@ -284,7 +282,6 @@ class DatabaseBlock extends AbstractBlock {
 		}
 
 		$blockQuery = self::getQueryInfo();
-		// @phan-suppress-next-line SecurityCheck-SQLInjection
 		$res = $db->select(
 			$blockQuery['tables'],
 			$blockQuery['fields'],

includes/diff/DifferenceEngineSlotDiffRenderer.php

@@ -54,7 +54,6 @@ class DifferenceEngineSlotDiffRenderer extends SlotDiffRenderer {
 	/** @inheritDoc */
 	public function getDiff( Content $oldContent = null, Content $newContent = null ) {
 		$this->normalizeContents( $oldContent, $newContent );
-		// @phan-suppress-next-line PhanTypeMismatchArgumentNullable Null handled by normalizeContents
 		return $this->differenceEngine->generateContentDiffBody( $oldContent, $newContent );
 	}
 

includes/filerepo/file/File.php

@@ -36,7 +36,6 @@ use MediaWiki\User\UserIdentity;
  * @ingroup FileAbstraction
  */
 
-// @phan-file-suppress PhanTypeMissingReturn false positives
 /**
  * Implements some public methods and some protected utility functions which
  * are required by multiple child classes. Contains stub functionality for

includes/htmlform/fields/HTMLAutoCompleteSelectField.php

@@ -44,7 +44,6 @@ class HTMLAutoCompleteSelectField extends HTMLTextField {
 
 		if ( array_key_exists( 'autocomplete-data-messages', $this->mParams ) ) {
 			foreach ( $this->mParams['autocomplete-data-messages'] as $key => $value ) {
-				// @phan-suppress-next-line PhanTypeMismatchArgument False positive, $key is documented as string
 				$key = $this->msg( $key )->plain();
 				$this->autocompleteData[$key] = strval( $value );
 			}

includes/htmlform/fields/HTMLCheckMatrix.php

@@ -99,7 +99,6 @@ class HTMLCheckMatrix extends HTMLFormField implements HTMLNestedFilterable {
 		// Build the column headers
 		$headerContents = Html::rawElement( 'td', [], "\u{00A0}" );
 		foreach ( $columns as $columnLabel => $columnTag ) {
-			// @phan-suppress-next-line PhanTypeMismatchArgument False positive, labels are documented as string
 			$headerContents .= Html::rawElement( 'th', [], $columnLabel );
 		}
 		$thead = Html::rawElement( 'tr', [], "\n$headerContents\n" );

includes/htmlform/fields/HTMLFormFieldCloner.php

@@ -485,7 +485,6 @@ class HTMLFormFieldCloner extends HTMLFormField {
 		}
 
 		$template = $this->getInputHTMLForKey( $this->uniqueId, [] );
-		// @phan-suppress-next-line SecurityCheck-DoubleEscaped data-template contains html, but that is okay here
 		$html = Html::rawElement( 'ul', [
 			'id' => "mw-htmlform-cloner-list-{$this->mID}",
 			'class' => 'mw-htmlform-cloner-ul',
@@ -558,7 +557,6 @@ class HTMLFormFieldCloner extends HTMLFormField {
 		}
 
 		$template = $this->getInputOOUIForKey( $this->uniqueId, [] );
-		// @phan-suppress-next-line SecurityCheck-DoubleEscaped data-template contains html, but that is okay here
 		$html = Html::rawElement( 'ul', [
 			'id' => "mw-htmlform-cloner-list-{$this->mID}",
 			'class' => 'mw-htmlform-cloner-ul',

includes/installer/DatabaseInstaller.php

@@ -229,7 +229,6 @@ abstract class DatabaseInstaller {
 		$this->db->setFlag( DBO_DDLMODE );
 		$this->db->begin( __METHOD__ );
 
-		// @phan-suppress-next-line SecurityCheck-PathTraversal False positive
 		$error = $this->db->sourceFile(
 			call_user_func( [ $this, $sourceFileMethod ], $this->db )
 		);

includes/installer/Installer.php

@@ -1377,7 +1377,6 @@ abstract class Installer {
 			$info += $jsonStatus->value;
 		}
 
-		// @phan-suppress-next-line SecurityCheckMulti
 		return Status::newGood( $info );
 	}
 

includes/installer/PostgresInstaller.php

@@ -196,7 +196,6 @@ class PostgresInstaller extends DatabaseInstaller {
 			$conn = $status->value;
 			$conn->clearFlag( DBO_TRX );
 			$conn->commit( __METHOD__ );
-			// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 			$this->pgConns[$type] = $conn;
 		}
 

includes/installer/WebInstaller.php

@@ -261,7 +261,6 @@ class WebInstaller extends Installer {
 
 		# Execute the page.
 		$this->currentPageName = $page->getName();
-		// @phan-suppress-next-line PhanTypeMismatchArgumentNullable pageName is not null here
 		$this->startPageWrapper( $pageName );
 
 		if ( $page->isSlow() ) {
@@ -275,7 +274,6 @@ class WebInstaller extends Installer {
 		if ( $result == 'skip' ) {
 			# Page skipped without explicit submission.
 			# Skip it when we click "back" so that we don't just go forward again.
-			// @phan-suppress-next-line PhanTypeMismatchDimAssignment pageName is not null here
 			$this->skippedPages[$pageName] = true;
 			$result = 'continue';
 		} else {

includes/installer/WebInstallerOptions.php

@@ -205,7 +205,6 @@ class WebInstallerOptions extends WebInstallerPage {
 				}
 				$skinHtml .=
 					'<div class="config-skins-item">' .
-					// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 					$this->parent->getCheckBox( [
 						'var' => "skin-$skin",
 						'rawtext' => $screenshotText,
@@ -299,14 +298,12 @@ class WebInstallerOptions extends WebInstallerPage {
 							}
 						}
 
-						// @phan-suppress-next-line SecurityCheck-XSS
 						$text = wfMessage( 'config-extensions-requires' )
 							->rawParams( $ext, $wgLang->commaList( $links ) )
 							->escaped();
 					} else {
 						$text = $ext;
 					}
-					// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 					$extHtml .= $this->parent->getCheckBox( [
 						'var' => "ext-$ext",
 						'rawtext' => $text,

includes/libs/ArrayUtils.php

@@ -89,7 +89,6 @@ class ArrayUtils {
 			}
 		}
 
-		// @phan-suppress-next-line PhanPossiblyUndeclaredVariable weight is non-empty and i is always set
 		return $i;
 	}
 

includes/libs/ParamValidator/TypeDef/UploadDef.php

@@ -114,6 +114,7 @@ class UploadDef extends TypeDef {
 		} else {
 			$constant = '';
 			foreach ( get_defined_constants() as $c => $v ) {
+				// @phan-suppress-next-line PhanTypeComparisonFromArray
 				if ( $v === $err && substr( $c, 0, 11 ) === 'UPLOAD_ERR_' ) {
 					$constant = " ($c?)";
 				}

includes/libs/WRStats/BagOStuffStatsStore.php

@@ -21,6 +21,10 @@ class BagOStuffStatsStore implements StatsStore {
 		$this->cache = $cache;
 	}
 
+	/**
+	 * @inheritDoc
+	 * @suppress PhanParamTooFewUnpack
+	 */
 	public function makeKey( $prefix, $internals, $entity ) {
 		if ( $entity->isGlobal() ) {
 			return $this->cache->makeGlobalKey(

includes/libs/mime/MimeAnalyzer.php

@@ -600,7 +600,6 @@ class MimeAnalyzer implements LoggerAwareInterface {
 			if ( str_starts_with( $head, $magic ) ) {
 				$this->logger->info( __METHOD__ .
 					": magic header in $file recognized as $candidate" );
-				// @phan-suppress-next-line PhanTypeMismatchReturn False positive
 				return $candidate;
 			}
 		}

includes/libs/objectcache/wancache/WANObjectCache.php

@@ -2321,6 +2321,7 @@ class WANObjectCache implements
 	 * @since 1.27
 	 */
 	public function makeGlobalKey( $collection, ...$components ) {
+		// @phan-suppress-next-line PhanParamTooFewUnpack Should infer non-emptiness
 		return $this->cache->makeGlobalKey( ...func_get_args() );
 	}
 
@@ -2335,6 +2336,7 @@ class WANObjectCache implements
 	 * @since 1.27
 	 */
 	public function makeKey( $collection, ...$components ) {
+		// @phan-suppress-next-line PhanParamTooFewUnpack Should infer non-emptiness
 		return $this->cache->makeKey( ...func_get_args() );
 	}
 

includes/libs/rdbms/database/DatabaseSqlite.php

@@ -782,7 +782,6 @@ class DatabaseSqlite extends Database {
 			}
 		}
 
-		// @phan-suppress-next-line SecurityCheck-SQLInjection SQL is taken from database
 		$res = $this->query(
 			$sqlCreateTable,
 			$fname,

includes/libs/rdbms/dbal/MWMySQLPlatform.php

@@ -1,9 +1,5 @@
 <?php
 
-/**
- * @phan-file-suppress PhanCommentAbstractOnInheritedMethod T298571
- */
-
 namespace Wikimedia\Rdbms;
 
 use Doctrine\DBAL\Platforms\MySQLPlatform;

includes/libs/rdbms/dbal/MWPostgreSqlPlatform.php

@@ -1,9 +1,5 @@
 <?php
 
-/**
- * @phan-file-suppress PhanCommentAbstractOnInheritedMethod T298571
- */
-
 namespace Wikimedia\Rdbms;
 
 use Doctrine\DBAL\Platforms\PostgreSQLPlatform;

includes/libs/rdbms/querybuilder/SelectQueryBuilder.php

@@ -261,6 +261,7 @@ class SelectQueryBuilder extends JoinGroupBase {
 				if ( is_int( $key ) ) {
 					$this->conds[] = $cond;
 				} elseif ( isset( $this->conds[$key] ) ) {
+					// @phan-suppress-previous-line PhanTypeMismatchDimFetch
 					// T288882
 					$this->conds[] = $this->db->makeList(
 						[ $key => $cond ], IDatabase::LIST_AND );

includes/logging/LogEventsList.php

@@ -683,6 +683,7 @@ class LogEventsList extends ContextSource {
 
 		if ( $logBody ) {
 			if ( $msgKey[0] ) {
+				// @phan-suppress-next-line PhanParamTooFewUnpack Non-emptiness checked above
 				$msg = $context->msg( ...$msgKey );
 				if ( $page instanceof PageReference ) {
 					$msg->page( $page );

includes/media/BitmapHandler.php

@@ -516,6 +516,7 @@ class BitmapHandler extends TransformationalImageHandler {
 		if ( $useQuality && isset( $params['quality'] ) ) {
 			$funcParams[] = $params['quality'];
 		}
+		// @phan-suppress-next-line PhanParamTooFewInternalUnpack,PhanParamTooFewUnpack There are at least 2 args
 		$saveType( ...$funcParams );
 
 		imagedestroy( $dst_image );

includes/media/SvgHandler.php

@@ -367,7 +367,6 @@ class SvgHandler extends ImageHandler {
 				$err = wfShellExecWithStderr( $cmd, $retval, $env );
 			}
 		}
-		// @phan-suppress-next-line PhanTypeMismatchArgumentNullable False positive
 		$removed = $this->removeBadFile( $dstPath, $retval );
 		if ( $retval != 0 || $removed ) {
 			// @phan-suppress-next-next-line PhanPossiblyUndeclaredVariable cmd is set when used

includes/page/ImagePage.php

@@ -490,7 +490,6 @@ class ImagePage extends Article {
 							[],
 							[ 'page' => $page - 1 ]
 						);
-						// @phan-suppress-next-line SecurityCheck-DoubleEscaped link getting a key, false positive
 						$thumb1 = Linker::makeThumbLinkObj(
 							$this->getTitle(),
 							$this->displayImg,
@@ -511,7 +510,6 @@ class ImagePage extends Article {
 							[],
 							[ 'page' => $page + 1 ]
 						);
-						// @phan-suppress-next-line SecurityCheck-DoubleEscaped link getting a key, false positive
 						$thumb2 = Linker::makeThumbLinkObj(
 							$this->getTitle(),
 							$this->displayImg,

includes/pager/IndexPager.php

@@ -830,6 +830,7 @@ abstract class IndexPager extends ContextSource implements Pager {
 		if ( $declaringClass !== __CLASS__ ) {
 			// Overriding makeLink() is deprecated since 1.39
 			$navBuilder->setMakeLinkCallback( function ( ...$args ) {
+				// @phan-suppress-next-line PhanParamTooFewUnpack
 				return $this->makeLink( ...$args );
 			} );
 		}

includes/parser/CoreParserFunctions.php

@@ -531,7 +531,6 @@ class CoreParserFunctions {
 					wfMessage( 'duplicate-displaytitle',
 						// Message should be parsed, but these params should only be escaped.
 						$converter->markNoConversion( wfEscapeWikiText( $old ) ),
-						// @phan-suppress-next-line SecurityCheck-DoubleEscaped we removed escaping above
 						$converter->markNoConversion( wfEscapeWikiText( $filteredText ) )
 					)->inContentLanguage()->text() .
 					'</span>';

includes/parser/CoreTagHooks.php

@@ -83,6 +83,7 @@ class CoreTagHooks {
 			[ '>', '<' ],
 			$content
 		);
+		// @phan-suppress-next-line SecurityCheck-XSS Ad-hoc escaping above.
 		return Html::rawElement( 'pre', $attribs, $content );
 	}
 

includes/parser/PPFrame_Hash.php

@@ -148,7 +148,6 @@ class PPFrame_Hash implements PPFrame {
 				}
 			}
 		}
-		// @phan-suppress-next-line SecurityCheck-XSS taint track for keys in named args, false positive
 		return new PPTemplateFrame_Hash( $this->preprocessor, $this, $numberedArgs, $namedArgs, $title );
 	}
 

includes/parser/PPTemplateFrame_Hash.php

@@ -174,7 +174,6 @@ class PPTemplateFrame_Hash extends PPFrame_Hash {
 		if ( !isset( $this->namedExpansionCache[$name] ) ) {
 			# Trim named arguments post-expand, for backwards compatibility
 			$this->namedExpansionCache[$name] = trim(
-				// @phan-suppress-next-line SecurityCheck-XSS
 				$this->parent->expand( $this->namedArgs[$name], PPFrame::STRIP_COMMENTS ) );
 		}
 		return $this->namedExpansionCache[$name];

includes/parser/Parser.php

@@ -690,7 +690,6 @@ class Parser {
 		// Strip U+0000 NULL (T159174)
 		$text = str_replace( "\000", '', $text );
 
-		// @phan-suppress-next-line PhanTypeMismatchArgumentNullable False positive
 		$this->startParse( $page, $options, self::OT_HTML, $clearState );
 
 		$this->currentRevisionCache = null;
@@ -2225,7 +2224,6 @@ class Parser {
 			# This means that users can paste URLs directly into the text
 			# Funny characters like ö aren't valid in URLs anyway
 			# This was changed in August 2004
-			// @phan-suppress-next-line SecurityCheck-XSS,SecurityCheck-DoubleEscaped using false for escape is valid
 			$s .= Linker::makeExternalLink( $url, $text, false, $linktype,
 				$this->getExternalLinkAttribs( $url ), $this->getTitle() ) . $dtrail . $trail;
 
@@ -3326,11 +3324,9 @@ class Parser {
 
 		# Replace raw HTML by a placeholder
 		if ( $isHTML ) {
-			// @phan-suppress-next-line SecurityCheck-XSS Mixed mode, here html and safe
 			$text = $this->insertStripItem( $text );
 		} elseif ( $nowiki && ( $this->ot['html'] || $this->ot['pre'] ) ) {
 			# Escape nowiki-style return values
-			// @phan-suppress-next-line SecurityCheck-DoubleEscaped Mixed mode, here html and safe
 			$text = wfEscapeWikiText( $text );
 		} elseif ( is_string( $text )
 			&& !$piece['lineStart']
@@ -4469,7 +4465,6 @@ class Parser {
 				// be able to convert that piece of data.
 				// Gets replaced with html in ParserOutput::getText
 				$editlink = '<mw:editsection page="' . htmlspecialchars( $editsectionPage, ENT_COMPAT );
-				// @phan-suppress-next-line SecurityCheck-DoubleEscaped
 				$editlink .= '" section="' . htmlspecialchars( $editsectionSection, ENT_COMPAT ) . '"';
 				$editlink .= '>' . $editsectionContent . '</mw:editsection>';
 			} else {
@@ -4583,7 +4578,6 @@ class Parser {
 		if ( $clearState ) {
 			$magicScopeVariable = $this->lock();
 		}
-		// @phan-suppress-next-line PhanTypeMismatchArgumentNullable False positive
 		$this->startParse( $page, $options, self::OT_WIKI, $clearState );
 		$this->setUser( $user );
 

includes/specialpage/AuthManagerSpecialPage.php

@@ -451,10 +451,12 @@ abstract class AuthManagerSpecialPage extends SpecialPage {
 				$status = Status::newFatal( new RawMessage( '$1', [ $status ] ) );
 			} elseif ( is_array( $status ) ) {
 				if ( is_string( reset( $status ) ) ) {
+					// @phan-suppress-next-line PhanParamTooFewUnpack
 					$status = Status::newFatal( ...$status );
 				} elseif ( is_array( reset( $status ) ) ) {
 					$ret = Status::newGood();
 					foreach ( $status as $message ) {
+						// @phan-suppress-next-line PhanParamTooFewUnpack
 						$ret->fatal( ...$message );
 					}
 					$status = $ret;

includes/specials/SpecialBlock.php

@@ -201,6 +201,7 @@ class SpecialBlock extends FormSpecialPage {
 				[
 					'align' => 'top',
 					'errors' => array_map( function ( $errMsg ) {
+						// @phan-suppress-next-line PhanParamTooFewUnpack Should infer non-emptiness
 						return new OOUI\HtmlSnippet( $this->msg( ...$errMsg )->parse() );
 					}, $this->preErrors ),
 				]

includes/specials/SpecialUploadStash.php

@@ -130,7 +130,6 @@ class SpecialUploadStash extends UnlistedSpecialPage {
 			$message = $e->getMessage();
 		}
 
-		// @phan-suppress-next-line PhanPossiblyUndeclaredVariable False positive
 		throw new HttpError( $code, $message );
 	}
 

includes/specials/forms/UploadForm.php

@@ -172,7 +172,6 @@ class UploadForm extends HTMLForm {
 		$descriptor = [];
 		if ( $this->mTextTop ) {
 			$descriptor['UploadFormTextTop'] = [
-				// @phan-suppress-next-line SecurityCheck-XSS mTextTop is raw html
 				'type' => 'info',
 				'section' => 'source',
 				'default' => $this->mTextTop,
@@ -339,7 +338,6 @@ class UploadForm extends HTMLForm {
 		];
 		if ( $this->mTextAfterSummary ) {
 			$descriptor['UploadFormTextAfterSummary'] = [
-				// @phan-suppress-next-line SecurityCheck-XSS mTextAfterSummary is raw html
 				'type' => 'info',
 				'section' => 'description',
 				'default' => $this->mTextAfterSummary,

includes/upload/UploadFromChunks.php

@@ -122,7 +122,6 @@ class UploadFromChunks extends UploadFromFile {
 		$this->getChunkStatus();
 
 		$metadata = $this->stash->getMetadata( $key );
-		// @phan-suppress-next-line SecurityCheckMulti,SecurityCheck-PathTraversal
 		$this->initializePathInfo( $name,
 			$this->getRealPath( $metadata['us_path'] ),
 			$metadata['us_size'],

includes/upload/UploadFromStash.php

@@ -100,7 +100,6 @@ class UploadFromStash extends UploadBase {
 		 * an opaque key to the user agent.
 		 */
 		$metadata = $this->stash->getMetadata( $key );
-		// @phan-suppress-next-line SecurityCheck-PathTraversal
 		$this->initializePathInfo( $name,
 			$initTempFile ? $this->getRealPath( $metadata['us_path'] ) : false,
 			$metadata['us_size'],

includes/user/User.php

@@ -871,6 +871,7 @@ class User implements Authority, UserIdentity, UserEmailContact {
 
 		if ( !$row ) {
 			// No user. Create it?
+			// @phan-suppress-next-line PhanImpossibleCondition
 			if ( !$options['create'] ) {
 				// No.
 				return null;
@@ -887,6 +888,7 @@ class User implements Authority, UserIdentity, UserEmailContact {
 
 		if ( !$user->isSystemUser() ) {
 			// User exists. Steal it?
+			// @phan-suppress-next-line PhanRedundantCondition
 			if ( !$options['steal'] ) {
 				return null;
 			}

maintenance/includes/MWDoxygenFilter.php

@@ -19,7 +19,6 @@
  *
  * @file
  * @ingroup Maintenance
- * @phan-file-suppress PhanInvalidCommentForDeclarationType False negative about `@var`
  */
 
 /**

maintenance/includes/TextPassDumper.php

@@ -703,6 +703,7 @@ TEXT
 			$failures++;
 
 			// A failure in a prefetch hit does not warrant resetting db connection etc.
+			// @phan-suppress-next-line PhanPossiblyUndeclaredVariable Control flow is hard to understand here.
 			if ( !$tryIsPrefetch ) {
 				// After backing off for some time, we try to reboot the whole process as
 				// much as possible to not carry over failures from one part to the other