Commit graph

46 commits

Author SHA1 Message Date
C. Scott Ananian
afd3dbaa95 Don't silently fail if API result fails to encode
Ensure that errors encoding API results produce actionable log entries.

Part of the follow-up to T210550.

Change-Id: I6f311451e3b07b540f14352ce25af9d74a053d19
2018-12-05 13:28:33 -05:00
Aryeh Gregor
edb52e7338 Improve ApiFormatJson test coverage
The only thing missing is tests for the rawfm paths, which I don't
understand well enough to test easily.

Change-Id: I08779391798b9d2d5eeb7e19ec4764059336069c
2018-10-08 13:42:20 +03:00
Tim Starling
f6d582a91e Avoid a redirect loop when the request URL is not normalized
If the request URL was not normalized, for example having a double slash
in it, this could cause it to fail to match in the PathRouter. But the
canonicalizing redirect was using the normalized URL, causing a redirect
loop exception.

So:

* If the PathRouter fails to match with the original URL, try matching
  against the normalized URL. This allows it to still work for
  normalized URLs with a double slash in the title part of the path.
* Have WebRequest::getFullRequestURL() always return the URL without
  removing dot segments or interpreting double slashes. Just append
  the path to the server.
* Make MediaWikiTest.php use WebRequest instead of FauxRequest, allowing
  it to reproduce the exception in question. Add relevant test.
* Add tests for the new PathRouter behaviour.

Bug: T100782
Change-Id: Ic0f3a0060904abc364f75dae920480b81175d52f
2018-07-16 15:55:59 +10:00
Bartosz Dziewoński
485f66f174 Use PHP 7 '??' operator instead of '?:' with 'isset()' where convenient
Find: /isset\(\s*([^()]+?)\s*\)\s*\?\s*\1\s*:\s*/
Replace with: '\1 ?? '

(Everywhere except includes/PHPVersionCheck.php)
(Then, manually fix some line length and indentation issues)

Then manually reviewed the replacements for cases where confusing
operator precedence would result in incorrect results
(fixing those in I478db046a1cc162c6767003ce45c9b56270f3372).

Change-Id: I33b421c8cb11cdd4ce896488c9ff5313f03a38cf
2018-05-30 18:06:13 -07:00
Fomafix
37789ebf45 Xml.php: Do not escape double quotes in $contents of Xml::element()
There is no need to escape double quotes in content of XML.
Html::element() also does not escape double quotes in content.

ENT_NOQUOTES escapes '<', '>' and '&' but not "'" and '"'.
https://secure.php.net/manual/en/function.htmlspecialchars.php

Change-Id: I3b585c43e532cca1a8951d6c9e8b4825fc3b012d
2018-05-23 20:03:54 +00:00
Timo Tijhof
665e9b7bf2 Convert OutputHandler functions to a class
* Convert OutputHandler.php from global functions to a class.

  - wfOutputHandler → OutputHandler::handle
    (no alias, no usage outside core)
  - wfGzipHandler → OutputHandler::handleGzip
    (private, no usage outside class)
  - wfRequestExtension → OutputHandler::findUriExtension
    (private, no usage outside class)
  - wfMangleFlashPolicy → OutputHandler::mangleFlashPolicy
    (private, no usage outside class)
  - wfDoContentLength → OutputHandler::emitContentLength
    (private, no usage outside class)
  - wfHtmlValidationHandler → OutputHandler::validateAllHtml
    (private, no usage outside class)

* Add the class to autoload.php for exposure outside WebStart.
  Specifically, for use in ApiFormatPhpTest. This also removes the
  need to manually load the class because this code runs after
  Setup.php loads AutoLoader.php.

Bug: T189966
Change-Id: I27a41ec0ae0ee30aeb313a616323b967605c4055
2018-03-20 21:11:32 -07:00
Brad Jorsch
7bc541a4a7 ApiFormatBase: Encode filenames in Content-Disposition
The return value for ApiFormatBase::getFilename() was formerly
documented as "must be encoded for inclusion in a Content-Disposition
header's filename parameter." While this is ok for the common use case
where the module is returning a constant string or can assume whatever
it gets back from getExtensionsForType() is ok, it's not in general a
good idea to make all callers handle that.

Further, it's not possible to represent characters outside of the
ISO-8859-1 character set in a 'filename' parameter. You have to use
'filename*' to do that (see RFC 5987 and RFC 6266).

So, this patch changes the definition of getFilename() to remove the
encoding requirement, and adds code to properly convert and escape the
value for the 'filename' and (if necessary) 'filename*' parameters.

Note this may give unexpected results (double encoding) if any module
actually is returning an encoded filename. I don't see any such cases in
core or in extensions in Gerrit.

Change-Id: I0c2749a847b639f228efff4e1917a61612a1f7d1
2018-02-07 15:12:33 -05:00
Umherirrender
45da581551 Use ::class to resolve class names in tests
This helps to find renamed or misspelled classes earlier.
Phan will check the class names

Change-Id: Ie541a7baae10ab6f5c13f95ac2ff6598b8f8950c
2018-01-26 22:49:13 +01:00
Phantom42
92e249c4dc Add tests for ApiFormatRaw
Bug: T183767
Change-Id: I63ce42dd61f6e47f7278c436cad1e4f05e287b04
2018-01-04 19:28:27 +02:00
Brad Jorsch
a8f5964cfe Add tests for ApiFormatBase
Ensuring proper behavior of the base class lets comprehensive tests of
subclasses be simpler.

This also adjusts ApiFormatTestBase to be a bit more usable, passing an
array of options through to encodeData() instead of just a class name.
And removes the unused 'SKIP' from testGeneralEncoding, but allows
expecting an exception (for use in I63ce42dd).

Change-Id: Ib2a1fa0b04860b09105376881ff8411f9534c453
2018-01-03 16:08:12 -05:00
Umherirrender
255d76f2a1 build: Updating mediawiki/mediawiki-codesniffer to 15.0.0
Clean up use of @codingStandardsIgnore
- @codingStandardsIgnoreFile -> phpcs:ignoreFile
- @codingStandardsIgnoreLine -> phpcs:ignore
- @codingStandardsIgnoreStart -> phpcs:disable
- @codingStandardsIgnoreEnd -> phpcs:enable

For phpcs:disable always the necessary sniffs are provided.
Some start/end pairs are changed to line ignore

Change-Id: I92ef235849bcc349c69e53504e664a155dd162c8
2018-01-01 14:10:16 +01:00
Brad Jorsch
4e6810e4a2 API: i18n for warnings and errors
API warnings and error messages are currently hard-coded English
strings. This patch changes that.

With a few exceptions, this patch should be compatible with non-updated
extensions:
* The change to ApiBase::$messageMap will blow up anything trying to
  mess with it.
* The changes to the 'ApiCheckCanExecute' hook will cause a wrong
  (probably unparsed) error message to be emitted for extensions not
  already using an ApiMessage. Unless they're currently broken like
  Wikibase.

Bug: T37074
Bug: T47843
Depends-On: Ia2b66b57cd4eaddc30b3ffdd7b97d6ca3e02d898
Depends-On: I2e1bb975bb0045476c03ebe6cdec00259bae22ec
Depends-On: I53987bf87c48f6c00deec17a8e957d24fcc3eaa6
Depends-On: Ibf93a459eb62d30f7c70d20e91ec9faeb80d10ed
Depends-On: I3cf889811f44a15935e454dd42f081164d4a098c
Depends-On: Ieae527de86735ddcba34724730e8730fb277b99b
Depends-On: I535344c29d51521147c2a26c341dae38cec3e931
Change-Id: Iae0e2ce3bd42dd4776a9779664086119ac188412
2016-12-06 10:20:48 -05:00
Brad Jorsch
f459c1aeca SECURITY: Improve cross-domain-policy mangling
Take into account that the tag might have parameters.

Bug: T123653
Change-Id: Ie9799f5ea45badfb4e7b4be7e7fbc1c35cc86f26

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
2016-05-20 09:48:11 -07:00
Reedy
83fb19cb13 Swap the rest of array() -> []
Change-Id: I76a7259ed952a0673a1941f08b39b545211fba07
2016-03-30 22:04:58 +00:00
Kunal Mehta
6e9b4f0e9c Convert all array() syntax to []
Per wikitech-l consensus:
 https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html

Notes:
* Disabled CallTimePassByReference due to false positives (T127163)

Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
2016-02-17 01:33:00 -08:00
Brad Jorsch
42e257a1a2 API: Remove dbg, txt, and yaml formats
Per RFC: https://www.mediawiki.org/wiki/Requests_for_comment/Ditch_crappy_API_formats

Bug: T95715
Change-Id: I8e4e9ad3c96504cf4587cb4632504eff21b5ff75
2015-11-18 09:19:51 -05:00
Amir E. Aharoni
c50cbe48ab Fix remaining Generic.Files.LineLength failures
Except the ones for which there is no clear way to fix
because of T114213.

Bug: T102614
Change-Id: I94a1fc7c890c82a36f0b51e42d311585c275775c
2015-10-03 17:23:07 +00:00
Amir E. Aharoni
94068c3e81 Fix Generic.Files.LineLength phpcs check under phpunit/includes/api
Bug: T102614
Change-Id: Ic0b3d9b58fee8dc20a976ae65dcb7072a3afc3b1
2015-10-03 17:18:05 +00:00
umherirrender
271da88127 Some bugzilla.wikimedia.org -> phabricator.wikimedia.org changes
Changed some old bugzilla links to new phabricator links in comments,
test data and error message. This reduces the need for redirects from
old bugzilla to new phabricator from our source code.

Change-Id: Id98278e26ce31656295a23f3cadb536859c4caa5
2015-09-24 17:17:25 +02:00
Max Semenik
b1876e3dd7 API: Remove WDDX and dump formats
Per RFC: https://www.mediawiki.org/wiki/Requests_for_comment/Ditch_crappy_API_formats

Change-Id: I4c9e64875be509906021255d70b90688f2e5ddf3
2015-07-01 11:43:39 -04:00
Brad Jorsch
4bbd86a859 API: Also mangle indexed tag names in format=xml
I had thought no one would be silly enough to set invalid tag names for
ApiResult::setIndexedTagName(), since it's specifically *for* XML tag
names. Apparently I was wrong.

Bug: T97599
Change-Id: I62ad832b1d8c23a275e5c67160f0b1febe5f3454
2015-04-30 09:02:17 -04:00
Brad Jorsch
beab6b009e Change API result data structure to be cleaner in new formats
Nothing in this patch should result in changed output for format=json or
format=php except as noted in RELEASE-NOTES-1.25, and changed output for
format=xml should be similar or cosmetic. However, other code accessing
the result data directly may need to be updated.

Bug: T87053
Bug: T12887
Change-Id: I3500708965cb8869b5aed1543381aad208dadd13
2015-04-20 17:49:37 -04:00
Brad Jorsch
1c57794e37 API: Overhaul ApiResult, make format=xml not throw, and add json formatversion
ApiResult was a mess: some methods could only be used with an array
reference instead of manipulating the stored data, methods that had both
array-ref and internal-data versions had names that didn't at all
correspond, some methods that worked on an array reference were
annoyingly non-static, and then the whole mess with setIndexedTagName.

ApiFormatXml is also entirely annoying to deal with, as it liked to
throw exceptions if certain metadata wasn't provided that no other
formatter required. Its legacy also means we have this silly convention
of using empty-string rather than boolean true, annoying restrictions on
keys (leading to things that should be hashes being arrays of key-value
object instead), '*' used as a key all over the place, and so on.

So, changes here:
* ApiResult is no longer an ApiBase or a ContextSource.
* Wherever sensible, ApiResult provides a static method working on an
  arrayref and a non-static method working on internal data.
* Metadata is now always added to ApiResult's internal data structure.
  Formatters are responsible for stripping it if necessary. "raw mode"
  is deprecated.
* New metadata to replace the '*' key, solve the array() => '[]' vs '{}'
  question, and so on.
* New class for formatting warnings and errors using i18n messages, and
  support for multiple errors and a more machine-readable format for
  warnings. For the moment, though, the actual output will not be changing
  yet (see T47843 for future plans).
* New formatversion parameter for format=json and format=php, to select
  between BC mode and the modern output.
* In BC mode, booleans will be converted to empty-string presence style;
  modules currently returning booleans will need to use
  ApiResult::META_BC_BOOLS to preserve their current output.

Actual changes to the API modules' output (e.g. actually returning
booleans for the new formatversion) beyond the use of
ApiResult::setContentValue() are left for a future change.

Bug: T76728
Bug: T57371
Bug: T33629
Change-Id: I7b37295e8862b188d1f3b0cd07f66ac34629678f
2015-04-10 16:57:15 -04:00
Reedy
4d9143c7f5 Add lots of @throws
Change-Id: I09d0c13070f966fcf23d2638d8fc1328279a5995
2014-12-24 13:49:20 +00:00
Brad Jorsch
39703e9318 Improve testing for ApiFormatBase subclasses
I7b37295e is going to be changing around how ApiResult works,
which is going to need corresponding changes in the formatters. So it
would probably be a good idea to have a decent starting point to catch
any breakage. The non-backwards-compatible changes to ApiFormatTestBase
shouldn't be a concern, as no extensions in Gerrit reference this class
or any /ApiFormat.*Test/ class.

This also fixes two small bugs in ApiFormatWddx (null handling and
spacing for non-fm slow path) discovered during testing, and works
around some HHVM wddx extension bugs.

Bug: T85236
Change-Id: I9cdf896e7070ed51e42625d61609ad9ef91cd567
2014-12-23 14:55:23 -05:00
Brad Jorsch
82fb734740 Skip ApiFormatWddxTest under HHVM
wddx_serialize_value() fails to escape the ampersand under HHVM. It has
been fixed upstream https://github.com/facebook/hhvm/issues/4283 but
has not been released yet.

When running under HHVM and detecting the ampersand is not escaped, skip
the test..

Bug: T75531
Change-Id: Ia58ec20b4daf78cd90da1bdf8af6cac86015c5d7
2014-12-18 16:57:49 +00:00
umherirrender
be3f554c95 Fix check for function wddx_deserialize in tests for hhvm
The @requires just works for other tests, not for php functions.

This fixed a failure for the hhvm test server:
1) ApiFormatWddxTest::testValidSyntax
Failed asserting that null is of type "array".

Change-Id: Iadd8238ce62d4803cdf56508886ad016f8ac8f1d
2014-12-10 22:25:25 +00:00
Brad Jorsch
d25cb99202 API: Clean up and internationalize pretty-printed output
The syntax highlighting applied to the XML format is not all that great,
and applying it to other formats is just wrong. Instead of doing it
ourselves, let's just add a hook and let Extension:SyntaxHighlight_GeSHi
do it for us.

But for that to work, we have to add RL support to the pretty-printed
output, which means OutputPage. At the same time, lets internationalize
the header.

Bug: 65403
Change-Id: I04b1a3842abdf1fb360c54aa7164fc7cd2e50f4b
2014-10-13 16:17:37 -07:00
Brad Jorsch
df457f3809 API: HTMLize and internationalize the help, add Special:ApiHelp
The existing API help, formatted as basically a plain-text document
embedded in XML and with a little bolding and a few links
syntax-highlighted in after the fact, works ok for experienced programmers
but isn't at all newbie-friendly. Further, all the help is hard-coded in
English, which isn't very friendly to non-English speakers.

So let's rewrite it. The help text is now obtained from i18n messages
and output in HTML, with the default display consisting of help for a
single module with links to help for other modules. This, of course,
necessitates deprecating many of the existing help-related methods and
hooks and replacing them with new ones, but backwards compatibility is
maintained for almost everything.

At the same time, action=paraminfo also needs to support the
'description' and other help-related fields being output in wikitext or
HTML, and I11cb063d (to access all modules via the 'modules' parameter
instead of having 'modules', 'formatmodules', 'querymodules', and so on)
is folded in.

And we also add Special:ApiHelp. When directly accessed, it simply
redirects to api.php with appropriate parameters. But it's also
transcludable to allow up-to-date API help text to be included within
the on-wiki documentation.

Note this patch doesn't actually add i18n messages for any API modules
besides ApiMain and ApiHelp. That will come in a followup patch, but for
the moment the backwards-compatibility code handles them nicely.

While we're messing with the documentation, we may as well add the
"internal" flag requested in bug 62905 (although the 'includeinternal'
parameter it also requests doesn't make much sense anymore) and a
"deprecated" flag that's needed by several modules now.

Bug: 30936
Bug: 38126
Bug: 42343
Bug: 45641
Bug: 62905
Bug: 63211
Change-Id: Ib14c00df06d85c2f6364d83b2b10ce34c7f513cc
2014-10-10 10:46:39 -04:00
Kunal Mehta
a1a78972a0 Add a test for ApiFormatNone
Because lolz.

Change-Id: I9c472131746a722737300b7d2d2291c70f80bb2e
2014-08-22 23:27:51 -07:00
csteipp
fe32899523 SECURITY: Prepend jsonp callback with comment
Mitigate CVE-2014-4671 for unpatched flash players

Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
2014-07-30 20:26:39 +02:00
umherirrender
092cd8ee31 Fixed some @params documentation (tests)
Swapped some "$var type" to "type $var" or added missing types
before the $var. Changed some other types to match the more common
spelling. Makes beginning of some text in captial.
Also added some missing @param.

Change-Id: Ic8aaf0a93796b97d0fa4617c1f86ff59f4b36131
2014-04-17 20:43:42 +02:00
Reedy
911fa591f0 Fix testValidyntax to testValidSyntax
Change-Id: I6157fec56a5455888200752d757602ddb640fd1e
2014-01-24 06:29:11 +00:00
Tim Starling
aebbe31a82 ApiFormatWddxTest @requires wddx_deserialize
Not the format module, that works fine without it, the test just fails.

Change-Id: I8135bbdbb070485bc3477fce474f36412f7547af
2013-11-05 17:06:23 +11:00
addshore
9577968280 Add more ApiFormat format tests
Adds tests for Json and wddx formats
Add @covers tags
Fixes some comments
Fixes scope

Change-Id: I5f22097ddcaeb917f856ba7aa0cb793caa17925e
2013-10-24 19:07:05 +01:00
addshore
de7af7ac2c Fix scope on all /phpunit test methods
Change-Id: I3ce92463d485a0fb23e464e9a8059330f32d79af
2013-10-24 10:31:32 +02:00
Siebrand Mazeland
791d0b2a98 Update code formatting
Change-Id: I16a9b42651f1cfb1a70dffbb67b7b83dfeb90d03
2013-04-26 14:21:20 +00:00
Siebrand Mazeland
9f77245218 Update formatting
4 of n.

Change-Id: I23e2409ce9eff14c3434154d236de83c93a92440
2013-02-14 14:10:38 +01:00
Antoine Musso
0fd05285d7 pass codesniffer on tests/
Fix almost all occurences of the following sniffs:

Generic.CodeAnalysis.UselessOverridingMethod.Found
Generic.Formatting.NoSpaceAfterCast.SpaceFound
Generic.Functions.FunctionCallArgumentSpacing.SpaceBeforeComma
Generic.Functions.OpeningFunctionBraceKernighanRitchie.BraceOnNewLine
Generic.PHP.LowerCaseConstant.Found
PSR2.Classes.PropertyDeclaration.ScopeMissing
PSR2.Files.EndFileNewline.TooMany
PSR2.Methods.MethodDeclaration.StaticBeforeVisibility

Change-Id: I96aacef5bafe5a2bca659744fba1380999cfc37d
2013-01-28 12:14:26 +01:00
Brad Jorsch
252ae6268b (bug 43762) Mark slow unit test as @group medium
All tests based on APITestCase can be slow. I've also seen more than one
Jenkins failure due to GlobalTest::testMerge timing out.

Also, added a meta-test on APITestCase to make sure that all its
subclasses are marked with @group medium or @group large, to prevent new
tests from re-causing the bug.

Change-Id: I48630736a3d06574876fd1fa3d90899cfbc48012
2013-01-18 14:07:49 -05:00
Antoine Musso
854b84ef42 enhance tests name (for --testdox option) 2011-07-03 18:09:30 +00:00
Chad Horohoe
85a5f0eb85 Merge ApiTestSetup into ApiTestCase and update all subclasses. The amount of duplication here was nasty, and also lets us get rid of a bunch of useless require_once()s.
./phpunit.php --filter Api currently gives me: Tests: 24, Assertions: 107, Incomplete: 1, Skipped: 2.
2011-07-01 16:34:02 +00:00
Platonides
c220da92bb Mark as needing a Database, as noted in r79532 CR.
It is needed for calling getServerVersion() to provide dbversion
2011-01-13 17:51:25 +00:00
Platonides
b75be64f49 Follow up r79532. Do not setup a user needlessly. 2011-01-05 19:35:58 +00:00
X!
ffa443c049 Followup to r79532: Did I really need to implement a parameter? No, I did not. 2011-01-04 01:35:01 +00:00
X!
4e4fa436fa Add API format testing 2011-01-03 21:36:49 +00:00