Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update git submodules

Browse source 
* Update extensions/AbuseFilter from branch 'REL1_43'
  to bc7e84a07c991ebd9251fb7d0cfb5829af50cbaf
  - SECURITY: Check protected variable access in CheckMatch API
    
    Why:
    * The AbuseFilter 'abusefiltercheckmatch' API allows users to
      check if abuse_filter_log rows or recentchange rows match against
      a provided pattern.
    * This currently does not check if the pattern attempts to match
      against protected variables that may be present in the variables
      generated for either the RecentChange or abuse_filter_log row.
    ** This allows users to trial-and-error work out the value of
       protected variables when they do not have access to the
       variables.
    * This should not be possible and proper access restrictions for
      protected variables should be applied.
    ** This includes logging when a caller is matching against
       protected variable values to avoid trial-and-error matching
       allowing an authorised user to see the value without creating
       a log entry.
    
    What:
    * Update CheckMatch::execute to:
    ** Reject attempts to match using a pattern that contains
       protected variables that the user cannot see the value of.
    ** Reject attempts to match against abuse_filter_log rows that have
       protected variable values that the user cannot see to be
       consistent with Special:AbuseLog access restrictions.
    ** Log when the provided pattern uses protected variables that
       have a value in the variable dump.
    * Add tests to verify this fix works.
    
    Bug: T397196
    Change-Id: I5f02572b94760141f6f57873409469318f441e18
This commit is contained in:
Dreamy Jazz 2025-07-23 14:52:08 +01:00 committed by Gerrit Code Review
parent 8188c1cbfd
commit 9d39b05391
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
extensions/AbuseFilter

@ -1 +1 @@
Subproject commit a8dbd6b44e929cd52d738de6623251f140c814fb
Subproject commit bc7e84a07c991ebd9251fb7d0cfb5829af50cbaf