Thijs/wiki.techinc.nl

History

C. Scott Ananian 94f193a894 SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization CVE-2025-32699 Ensure that Unicode NFC normalization can be applied to our HTML output safely. Even though the W3C officially recommends against normalizing HTML https://www.w3.org/International/questions/qa-html-css-normalization#converting this is still easily done inadvertently, especially when using the MediaWiki action API which normalizes parameters and results by default. See also I671648603c4635a35585c860b4857f5ea085e47f in Parsoid, and T266140 / I2e78e660ba1867744e34eda7d00ea527ec016b71 for another similar issue. The following changes are made: * The various HTML serializers (Remex/Tidy-derived, as well as the Html::* helpers) are tweaked to entity-escape U+0338 wherever it appears. * Similarly, Message::escaped() is tweaked to entity-escape U+0338. * Finally, a post-processing pass is added to the OutputTransform pipeline to catch any remaining U+0338 and entity-escape them. This catches U+0338 added during any of the previous OutputTransform stages (like TOC insertion, section edit links, etc). When backporting this code will likely need to be moved to ParserOutput::getText(), as the OutputTransform pipeline wasn't added until MW 1.42. Bug: T387130 Change-Id: I66564e14e730f5393f4fa5780b80f24de6075af5		2025-04-10 15:56:06 +01:00
..
data	Merge "Add namespace to maintenance/includes classes"	2024-10-15 22:50:33 +00:00
docs	Add namespace to maintenance/includes classes	2024-10-09 11:02:09 -04:00
includes	SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization	2025-04-10 15:56:06 +01:00
integration/includes	REST: Remove unused setUseParserCache() as potential footgun	2025-04-05 11:35:48 +00:00
maintenance	tests: Use namespaced classes	2024-10-21 18:53:02 +02:00
mocks	AutoLoader: Use require_once rather than require	2024-10-24 01:36:18 +00:00
structure	Add DumpableObjectsTest to the database test group	2024-11-08 14:37:40 +00:00
suites	tests: Use namespaced classes	2024-10-21 18:53:02 +02:00
tests	tests: Add missing documentation to class properties	2024-09-18 17:25:42 +00:00
unit	SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization	2025-04-10 15:56:06 +01:00
bootstrap.common.php	Deprecate $wgCommandLineMode	2024-01-02 22:21:50 +01:00
bootstrap.integration.php	phpunit: Deprecate suite.xml and composer phpunit:entrypoint	2023-12-21 08:22:35 +00:00
bootstrap.maintenance.php
bootstrap.php	phpunit: Fix bootstrap script when no extensions are installed	2025-02-21 22:24:30 +00:00
DynamicPropertyTestHelper.php	tests: Update @since tags for backports	2024-04-08 16:09:42 +01:00
getPHPUnitExtensionsAndSkins.php	phpunit: Fix bootstrap script when no extensions are installed	2025-02-21 22:24:30 +00:00
HamcrestPHPUnitIntegration.php
JsonSchemaAssertionTrait.php	REST: validate JSON in tests	2024-09-20 15:42:32 +00:00
MediaWikiCoversValidator.php
MediaWikiDeprecatedConfigPHPUnitExtension.php	phpunit: Deprecate suite.xml and composer phpunit:entrypoint	2023-12-21 08:22:35 +00:00
MediaWikiGroupValidator.php
MediaWikiIntegrationTestCase.php	tests: Use namespaced classes	2024-10-21 18:53:02 +02:00
MediaWikiLangTestCase.php	Use MediaWikiIntegrationTestCase::getConfVar in tests	2024-08-06 12:52:34 +00:00
MediaWikiLoggerPHPUnitExtension.php
MediaWikiPHPUnitResultPrinter.php
MediaWikiTeardownPHPUnitExtension.php
MediaWikiTestCaseTrait.php	Use explicit nullable type on parameter arguments	2024-10-16 20:58:33 +02:00
MediaWikiUnitTestCase.php	tests: Add missing documentation to class properties	2024-09-18 17:25:42 +00:00
MWTestDox.php
phpunit.php	phpunit: Don't override --bootstrap if supplied	2025-01-13 15:14:27 +00:00
README.md
ResourceLoaderTestCase.php	Use explicit nullable type on parameter arguments	2024-10-16 20:58:33 +02:00
suite.xml	phpunit: Deprecate suite.xml and composer phpunit:entrypoint	2023-12-21 08:22:35 +00:00
TestSelectQueryBuilder.php	Expand tests for rename user maintenance scripts	2024-10-08 21:51:59 +01:00

README.md

MediaWiki PHPUnit tests

WARNING: Integration tests may be destructive and alter or remove parts of your local database. We try to use temporary tables where possible, but you must never run tests on a production server or on a wiki where you don't want to lose data.

Running tests

If you haven't already, run composer update (specifically without --no-dev) in the MediaWiki core directory. This will install PHPUnit.

To read about how to run specific tests, refer to:

https://www.mediawiki.org/wiki/Manual:PHP_unit_testing/Running_the_tests

Writing tests

A guide to writing PHPUnit tests for MediaWiki can be found at:

https://www.mediawiki.org/wiki/Manual:PHP_unit_testing