Exception is thrown on Special:EntityData with an invalid flavor param
Closed, ResolvedPublic3 Estimated Story PointsPRODUCTION ERROR
Actions

Assigned To

Authored By

	Michael
	Jul 7 2021, 9:51 AM

Description

Example exception on beta: https://wikidata.beta.wmflabs.org/wiki/Special:EntityData/Q533192.ttl?flavor=invalid

Error

mwversion: 1.37.0-wmf.12
reqId: 4a4e5b9a-b9f5-45ad-af9d-887276b5e34c
Find reqId in Logstash
Find normalized_message in Logstash

normalized_message

[{reqId}] {exception_url}   MWException: Unsupported flavor: test ORDER BY 5064#

exception.trace

from /srv/mediawiki/php-1.37.0-wmf.12/extensions/Wikibase/repo/includes/LinkedData/EntityDataSerializationService.php(346)
#0 /srv/mediawiki/php-1.37.0-wmf.12/extensions/Wikibase/repo/includes/LinkedData/EntityDataSerializationService.php(372): Wikibase\Repo\LinkedData\EntityDataSerializationService->getFlavor(string)
#1 /srv/mediawiki/php-1.37.0-wmf.12/extensions/Wikibase/repo/includes/LinkedData/EntityDataSerializationService.php(171): Wikibase\Repo\LinkedData\EntityDataSerializationService->createRdfBuilder(string, string)
#2 /srv/mediawiki/php-1.37.0-wmf.12/extensions/Wikibase/repo/includes/LinkedData/EntityDataRequestHandler.php(558): Wikibase\Repo\LinkedData\EntityDataSerializationService->getSerializedData(string, Wikibase\Lib\Store\EntityRevision, NULL, array, string)
#3 /srv/mediawiki/php-1.37.0-wmf.12/extensions/Wikibase/repo/includes/LinkedData/EntityDataRequestHandler.php(283): Wikibase\Repo\LinkedData\EntityDataRequestHandler->showData(WebRequest, OutputPage, string, Wikibase\DataModel\Entity\ItemId, integer)
#4 /srv/mediawiki/php-1.37.0-wmf.12/extensions/Wikibase/repo/includes/Specials/SpecialEntityData.php(111): Wikibase\Repo\LinkedData\EntityDataRequestHandler->handleRequest(string, WebRequest, OutputPage)
#5 /srv/mediawiki/php-1.37.0-wmf.12/includes/specialpage/SpecialPage.php(646): Wikibase\Repo\Specials\SpecialEntityData->execute(string)
#6 /srv/mediawiki/php-1.37.0-wmf.12/includes/specialpage/SpecialPageFactory.php(1362): SpecialPage->run(string)
#7 /srv/mediawiki/php-1.37.0-wmf.12/includes/MediaWiki.php(314): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, RequestContext)
#8 /srv/mediawiki/php-1.37.0-wmf.12/includes/MediaWiki.php(917): MediaWiki->performRequest()
#9 /srv/mediawiki/php-1.37.0-wmf.12/includes/MediaWiki.php(551): MediaWiki->main()
#10 /srv/mediawiki/php-1.37.0-wmf.12/index.php(53): MediaWiki->run()
#11 /srv/mediawiki/php-1.37.0-wmf.12/index.php(46): wfIndexMain()
#12 /srv/mediawiki/w/index.php(3): require(string)
#13 {main}

Impact

logspam
could be used as endpoint for DOS attacks as it circumvents edge-caches

Acceptance Criteria 🏕️🌟

An exception does not make it's way to the user and does not get logged (the user sees a nice unlogged error instead)

Notes

This came up previously as T272534: EntityDataSerializationService - Possible SQL Injection (It is not in fact an SQL injection)

Details

Request URL: https://www.wikidata.org/wiki/Special:EntityData/Q39825.ttl?flavor=*

	Subject	Repo	Branch	Lines +/-
	Fix message parameter type in EntityDataRequestHandler	mediawiki/extensions/Wikibase	master	+1 -1
	Handle unknown flavor errors better	mediawiki/extensions/Wikibase	master	+88 -23

Customize query in gerrit

Related Objects

Mentioned Here: T272534: EntityDataSerializationService - Possible SQL Injection

Event Timeline

Michael created this task.Jul 7 2021, 9:51 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 7 2021, 9:51 AM

Addshore moved this task from Inbox to To Prioritize on the [DEPRECATED] wdwb-tech board.Jul 13 2021, 11:31 AM

Addshore added a project: Wikidata-Campsite.Jul 14 2021, 9:31 AM

Addshore moved this task from Incoming to Prioritized Wikidata Tech Backlog (prioritised from top to bottom) on the Wikidata-Campsite board.

Addshore moved this task from To Prioritize to Triaged High (100+) on the [DEPRECATED] wdwb-tech board.Jul 14 2021, 9:41 AM

Addshore updated the task description. (Show Details)Jul 14 2021, 9:49 AM

Addshore triaged this task as Medium priority.Jul 14 2021, 10:06 AM

Addshore set the point value for this task to 3.Jul 14 2021, 10:36 AM

Addshore moved this task from Prioritized Wikidata Tech Backlog (prioritised from top to bottom) to Wikidata-Campsite-Iteration-∞ (On Hold) on the Wikidata-Campsite board.Jul 14 2021, 11:03 AM

Addshore edited projects, added Wikidata-Campsite (Wikidata-Campsite-Iteration-∞ (On Hold)); removed Wikidata-Campsite.

Addshore moved this task from Triaged High (100+) to Active on the [DEPRECATED] wdwb-tech board.Jul 14 2021, 11:12 AM

Maintenance_bot moved this task from incoming to in progress on the Wikidata board.Jul 14 2021, 11:15 AM

Krinkle moved this task from Untriaged to July 2021 on the Wikimedia-production-error board.Jul 14 2021, 6:49 PM

Lucas_Werkmeister_WMDE claimed this task.Jul 23 2021, 2:01 PM

Lucas_Werkmeister_WMDE moved this task from To Do (prioritised from top to bottom) to Doing on the Wikidata-Campsite (Wikidata-Campsite-Iteration-∞ (On Hold)) board.

Change 707388 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/Wikibase@master] Handle unknown flavor errors better

https://gerrit.wikimedia.org/r/707388

gerritbot added a project: Patch-For-Review.Jul 23 2021, 2:45 PM

Lucas_Werkmeister_WMDE moved this task from Doing to Peer Review on the Wikidata-Campsite (Wikidata-Campsite-Iteration-∞ (On Hold)) board.Jul 23 2021, 2:58 PM

Change 707388 merged by jenkins-bot:

[mediawiki/extensions/Wikibase@master] Handle unknown flavor errors better

https://gerrit.wikimedia.org/r/707388

ReleaseTaggerBot added a project: MW-1.37-notes (1.37.0-wmf.16; 2021-07-26).Jul 26 2021, 3:00 PM

Lucas_Werkmeister_WMDE moved this task from Peer Review to Test (Verification) on the Wikidata-Campsite (Wikidata-Campsite-Iteration-∞ (On Hold)) board.Jul 26 2021, 3:05 PM

Maintenance_bot removed a project: Patch-For-Review.Jul 26 2021, 3:11 PM

Verified on beta

Wait, but that was supposed to be a comma-separated list. Did I break it with the last patch set?

Change 708511 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/Wikibase@master] Fix message parameter type in EntityDataRequestHandler

https://gerrit.wikimedia.org/r/708511

Lucas_Werkmeister_WMDE reopened this task as Open.Jul 28 2021, 11:56 AM

Lucas_Werkmeister_WMDE moved this task from Test (Verification) to Peer Review on the Wikidata-Campsite (Wikidata-Campsite-Iteration-∞ (On Hold)) board.

gerritbot added a project: Patch-For-Review.Jul 28 2021, 11:56 AM

Change 708511 merged by jenkins-bot: