The "nonce" CSP feature has been never been properly tested and is not
on track to be enabled at WMF or in MW by default. The use of
nonce-protected eval is not particularly meaningful. It is trivially
bypassed by mw.loader.implement, mw.loader.store, or importScript();
all of which allow any code to be executed directly, or to be stored
and loaded from a first-party origin.
The "nonce" feature is not required for the T208188 roadmap, and with
change I51b8535b2b21a3 there is now also a (small) performance reason
to keep this disabled long-term.
Until and unless there is a plan for enabling this particular aspect
of CSP, we might as well remove it so that we don't waste time our
time building abstraction layers and satisfying dependency injection
through many years for something that might never be used.
Note that this does not remove CSP support from ResourceLoader, and
does not take away from the future of enabling CSP in MediaWiki to
e.g. strictly block third-party scripts, or to require domains to
opt-in by site config or user pref (T208188).
Change-Id: I5a176c41a06a484a11e64bdacdc42b40811fe72e
It's awkward to construct a source map when the file contents is
modified after loading. Delivering deprecation warnings as JS code
seems like an odd convention anyway.
So, send the module deprecation warning as an additional parameter to
mediawiki.loader.implement().
Deprecation warnings are no longer displayed in only=scripts mode.
Remove deprecation tests from FileModuleTest since FileModule no longer
has any relevant deprecation code. Add tests to ModuleTest.
Deprecate Module::getDeprecationInformation().
Bug: T47514
Change-Id: I20938cf4ab78afc9a2d72fbd163a7c5f21755820
Some non-database tests are currently accessing the database. Fixing
them means either avoiding the DB access if it's possible and makes
sense for the test, or adding the `Database` group otherwise. In
particular:
- Replace global/static functions with services in a couple places to
make testing easier.
- RevisionRendererTest needs to be in the Database group due to heavy
global state usage (including DB) by Parser
- ActionFactoryIntegrationTest and SpecialPageFatalTest should be in
the database group because they test many different classes, and some
of which may use the database in the tested methods.
- SpecialUserLogoutTest must be in the database group because of User.
- Some pager tests are using wfGetDB directly.
Change-Id: I96eb2acf9a2cbfd17e81225db2773d5e8e30260b
These methods really belong in the Html class, not Xml. Leave behind
soft-deprecated Xml methods that forward to the Html ones, as well as a
class alias for HtmlJsCode (renamed from XmlJsCode).
Bug: T341779
Change-Id: I99a5f9de1411d4eb5ee30226b4e8ace3ea8b2c3b
The code appeared such that `getUrl(,'rasterized')` is still in active
use and somehow exposed, but it wasn't. Remove it as such, since the
parameter isn't used.
Bug: T329127
Bug: T321394
Change-Id: I32209b5c7628eea874dc0dbdb0bb361098fd2da8
Creates a new resourceLoader module which holds the
scripts and styles related to the temp user (IP masking) banner
described in T339379.
The temp user banner includes a tooltip which explains
what temporary accounts are. This is built using OO.ui.PopupWidget
and includes a clock icon and parsed i18n messages.
The Tooltip dependencies are loaded and instantiated on a click event
in order to minimize the dependencies on page load.
Bug: T339379
Change-Id: Ie2631221b0a07dd3bf55e970805d30fbb3cac190
Depends-on: Id5a4a9a00e50420c50868c54f899d36d7ddd373d
Depends-on: Icf622c4be910f5d14de95355efa02c05930179bf
Creates a new skin component for informing users with
temporary accounts that they can login or register if they choose.
Adds:
- New skin component: SkinComponentTempUserBanner.php
- Skin feature: "temp-user-banner"
- Associated styles
- New i18n messages for banner
NOTE: This component is not registered via the skinComponentRegistry
because it doesn't output any data, only a string of HTML.
Instead it is appended to the body element before the skin is rendered.
Bug: T330510
Change-Id: I1e137dbd29f3c73efac901f43f8a8258e2a111fc
To implement source maps, we want FileModule::getScript() to return
an array with path information, but that would break subclasses of
FileModule which concatenate to the return value of parent::getScript().
So allow scripts to be generated by a callback, eliminating the need for
concatenation in subclasses.
* Factor out most of the loop body of expandPackageFiles() into
expandFileInfo(). Add 'name' to the return value. Ensure 'filePath'
is always a FilePath object since we need that to safely return it
to ResourceLoader later. Document the return value.
* Make sure the base path is always set in FilePath objects returned by
expandFileInfo().
* Factor out the loop body of the final stage of file info expansion
into readFileInfo(). Retain filePath, do not unset it.
* Assert that $fileInfo['content'] is definitely set.
* Convert array_map() in getDefinitionSummary() to a loop.
* Migrate LanguageDataModule.
Bug: T47514
Change-Id: I97d61b5793159cea365740e0563f7b733e0f16de
Syntactical leftover with no significance in modern web.
Bug: T309150
Depends-On: I3a029ca950db42b938962b2452ad136ae8ddea6f
Depends-On: Id0557ac19583de36d7226b14a4c06933da47fe97
Depends-On: I17580a72e4a9384d7d774866e610197e950900cb
Change-Id: I4bbfa47fbf6e30fb90d920d6d02cdf6e0b1cdb46
Follows-up I992ccde79a59ad51c.
* Soften the test to only asserting that an exception is thrown,
the type isn't part of the API.
* Throw RuntimeException instead of MWException per T86704.
Bug: T86704
Bug: T328602
Change-Id: Ifaa5d659941d60789ca14f771648e5830bbef317
Importing Less files from @wikimedia/codex-design-tokens/ doesn't work,
on purpose. Instead of letting these imports fail with a nondescript
"file not found" error that doesn't help the developer understand why it
didn't work, provide a descriptive error message that points them in the
right direction.
Bug: T328602
Change-Id: I992ccde79a59ad51c7ebfe3ac7548a6e531f4a59
The UA sniffs that overrode the feature tests are no longer needed.
* MSIE 10: Fine, rejected by feature checks.
* UC Mini "Speed Mode": Redundant, the version that this sniff
matched is pre-ES6. Current versions of UC Mini don't appear to
support enabling "Speed Mode" on random websites nor does it offer
it for Wikipedia specifically.
Details at https://phabricator.wikimedia.org/T178356#8740573.
* Google Web Light: Redundant, shutdown as of 2022.
Any references or extensions that still reach the proxy, get
redirected to our online URLs
https://googleweblight.com/?lite_url=https://en.m.wikipedia.org/wiki/Bananahttps://phabricator.wikimedia.org/T152602https://en.wikipedia.org/wiki/Google_Web_Light
* MeeGo: Redundant, discontinued and presumed rejected.
Either way, unsupported.
* Opera Mini: Fine, rejected by checks.
Details at https://phabricator.wikimedia.org/T178356#8740573.
* Ovi Browser: Redundant, discontinued and presumed rejected.
Either way, unsupported.
* Google Glass: Improve UX (since 2013, T58008).
* NetFront: Redundant. Old versions are presumed rejected.
Current versions are Chromium-based and presumed fine.
The exclusion was not UX based, but due to jQuery explicitly not
supporting it in 2013. This is no longer the case, so we can let
the feature test lead the way here.
* PlayStation: Redundant, same story as NetFront.
The version that matched the sniff is presumed rejected.
Current versions probably fine, but even not, don't match
our sniff so are already enabled today.
Bug: T178356
Change-Id: Ib6263ce3ffd11af5e501de8857f3e48a248c6210
This replaces the hacky wrapper files in
resources/src/mediawiki.less/mediawiki.skin.codex-design-tokens/ and
resources/src/medawiki.less/@wikimedia/codex-icons/dist/ with real
import path aliasing/remapping.
Bug: T328602
Change-Id: I2df266cde90d1b8dad8d1d1367b67001e2b2984d
* Unnecessary regex modifier. I agree with this inspection which flags
/s modifiers on regexes that don't use a dot.
* Property declared dynamically.
* Unused local variable. But it's acceptable for an unused local
variable to take the return value of a method under test, when it is
being tested for its side-effects. And it's acceptable for an unused
local variable to document unused list expansion elements, or the
nature of array keys in a foreach.
Change-Id: I067b5b45dd1138c00e7269b66d3d1385f202fe7f
Just methods where adding "static" to the declaration was enough, I
didn't do anything with providers that used $this.
Initially by search and replace. There were many mistakes which I
found mostly by running the PHPStorm inspection which searches for
$this usage in a static method. Later I used the PHPStorm "make static"
action which avoids the more obvious mistakes.
Bug: T332865
Change-Id: I47ed6692945607dfa5c139d42edbd934fa4f3a36
The $modules param is user controlled. We already catch invalid UTF-8
in server configurations. If something like that makes it here, the
only place it can come from is the client doing it intentionally,
such as the result of scanning tools.
Follows-up I89832142b, which silenced $modules formatting in a CSS
response. This patch also covers the case of a JS response, and adds a
test for both.
Bug: T331641
Change-Id: I03a0ec262203509f069654e7fa6fd8d8debd25d5
We always wrap the local cluster cache, and there are no subclasses
of WANObjectCache. It was never documented or recommended how these
would be used. It is a left-over from the original 2015 Multi-DC plan
in which WANObjectCache would work differently. See task for details.
Note that this requires no configuration changes, even in the
theoretical case of these variables being used, as the only
option is to use the main cache, and that's also the default.
* Update WAN overrides to override the underlying main cache
instead.
* Fix EditPageTest which was previously implicitly using a 'hash'
as main cache but also relying on wan cache to be 'none'.
The part that it actually needs is the 'none'. When WAN cache is
enabled, testUpdateNoMinor fails due to an edit conflict because
one of the edits it makes is made with a current timestamp whereas
it expects to simulate wpEdittime in the year 2012 which, when
caching is enabled, is ignored and becomes the current time instead.
I don't understand exactly why, but I'm going to conserve that
behaviour for now.
* Fix TemplateCategoriesTest, which was failing due to an unexpected
cache hit:
> [objectcache] fetchOrRegenerate(…:page:10:…): volatile hit
This could be solved in a more realistic way by splitting the test,
or by explicitly resetting services half-way the test to clear
WikiPageFactory, PageStore and WANCache process state.
For now, keep the prior behaviour of no cache in this test.
Bug: T305093
Bug: T329680
Depends-On: If890622eed0d0f8b4bd73d36ba1815a3d760ea05
Depends-On: Ie1def75208822bdf19bb2cfd7e6edf32c2000e6b
Depends-On: I35cce61dc3ee90dcee3dd6f0b36f84133be029ed
Change-Id: I53781a8c06ebb2583f6ca83dd91bbfe8a5c88b13
Subclasses of Maintenance that can function without database access can
now override canExecuteWithoutLocalSettings to return true.
This is useful for scripts that need to be able to run before or without
installing MediaWiki.
When no config file is present, the storage backend will be disabled.
Any attempt to access the database will result in an error.
NOTE: This makes MediaWikiServices::disableBackendServices() more
comprehensive, to avoid premature failures during service
construction. This change makes it necessary to adjust how the
installer manages service overrides.
The CLI installer is covered by CI, I tested the web installer
manually.
Change-Id: Ie84010c80f32cbdfd34aff9dde1bfde1ed531793
Similar to the exception thrown by ResourceLoader::makeConfigSetScript,
but non-fatal so as to generally allow more things to continue working
without it being silent and without giving up visibility through
Logstash.
Bug: T329330
Change-Id: I89832142b55ec0f4d1168314a897624e13ac8a0f
This allows the body classes of skins to be customized for anonymous
users. Enable using $wgResourceLoaderClientPreferences = true;
* Only classes of the form <prefix>-(disabled|enabled)
can be toggled.
* For now no client side API is provided as this should not be
considered stable.
* Storage mechanism is cookie, stored under "mwclientprefs"
* Preferences apply to all skins. This means setting a preference
in Vector 2022 would also lead to class manipulation in Minerva.
This is by design to allow for skin-agnostic preferences. Up to
caller to make sure the class being manipulated is limited to the
skin if required ie. don't use generic classes.
* Avoids try/catch and JSON parsing by storaging as a string
* Places inline script before body tag before first stylesheet to
avoid breaking the article's ability to parse the article
concurrently with stylesheet download.
Usage:
Given a document with classes
"client-js vector-feature-limited-width-enabled ext-feature-enabled"
Set:
document.cookie = 'mwclientprefs=vector-feature-limited-width'
Will result in toggling off the limited width.
Bug: T321498
Change-Id: Ic3b6eec19953932c697ab5bf48c33a4ac1841b07
Mocks a ContainerInterface to support a specific list of services,
with has() and get() working correctly, and uses that for a real
ObjectFactory object.
Change-Id: Ie49b5a34e0f449cc4b9f6b31d6cc1bc943d04b43
First step towards constraining how the targets system can be used
with the eventual goal of dismantling target system altogether.
As part of the many modernization efforts in place, we should
be targeting mobile experiences by default. For now I am
targeting only modules that are writing ES6 code for desktop
only. In future this should be expanded to modules using
packageFiles and modules targetting mobile only.
The implication of this change is that any ES6 module that has
not specified targets, will now automatically load on mobile site.
In the case of the 3 depends-on there doesn't seem to be any
problem with targeting mobile as the way these modules are
loaded is restricted based on context.
We will log warnings to inform us where modules disobey this
rule.
Bug: T323542
Depends-On: I2e31ba2bd2aea192f428531f6c92afa551448fef
Change-Id: Iff6bfbba406dec5b8c8be644dbf21ee3b3879fda
And also assertNotRegExp -> assertDoesNotMatchRegularExpression. The
methods were renamed in PHPUnit 9.
Done automatically with:
grep -rl assertRegExp tests/ | xargs sed -r -i "s/>assertRegExp\(/>assertMatchesRegularExpression\(/"
grep -rl assertNotRegExp tests/ | xargs sed -r -i "s/>assertNotRegExp\(/>assertDoesNotMatchRegularExpression\(/"
Split out from Ifdba0f9e98eb6bce4590b7eb73170c51a697d7c6 so that it
remains smaller and easier to review.
Also make a test use MediaWikiUnitTestCase (it's already in the unit/
dir) so that it can access the forward-compat method.
Bug: T243600
Change-Id: Ifa279d5f201d7abeebece292141ebface8278046
While working on the site notice in Vector we've noticed these
styles are proving more problematic than helpful so splitting these
up allows us more granularity in the styles we ship.
The core interface styles are now enabled by default as they contain
important logic relating to empty portlets and the print footer
Bug: T316027
Change-Id: Ib5ae640bb260cee46e654228b785c776722c7003
I consider it busywork to maintain this, for no tangible benefit.
Limiting the credited coverage to a class is limiting enough to
exclude unintended coverage from reports. Especially as this
helps ensure tracking coverage correctly for implementation details
such as helper methods and internal methods that do not warrant
their own test as that would defeat the purpose of tests exercising
the contract and demonstrating good usage.
Change-Id: Icf865f15cbd86585bbc02fc4943a960efb40c0eb
Calling ->onlyMethods( [] ) with an empty array does have an effect.
By default, all methods are mocked, which means the original code is
not called. Calling ->onlyMethods( [] ) turns this around. No methods
are mocked but all call the original code.
This is almost the same as ->enableProxyingToOriginalMethods(). The
difference is that ->enableProxyingToOriginalMethods() also requires
the original constructor to be called, but ->onlyMethods( [] ) does
not.
We can get rid of this confusing setup in tests that don't need it.
All tests in this patch that succeed with a simple ->createMock()
just demonstrated that they don't need it.
Change-Id: I341323a1ca793c039498f80b7f073c124b6b6ae0
Cover code in `respond()` and `makeModuleResponse()` relating to
responding for a module that does not exist (yet, or not anymore).
Change-Id: I17db551adf6efaf0272ae063be8b2b5c3a73abc7
