Semanticmediawiki: System messages need escaping

[kghbln]

Setup and configuration

• MediaWiki 1.28.0-rc.1 (79498f9) 01:05, 17. Nov. 2016
• PHP 5.6.27-0+deb8u1 (apache2handler)
• MariaDB 10.0.28-MariaDB-1~jessie
• Semantic MediaWiki 2.5.0-alpha (7f351b7) 14:35, 26. Nov. 2016

Issue

Reported here: https://github.com/SemanticMediaWiki/SemanticMediaWiki/pull/2052 via T85864

This does not fix escaping of "smw-datavalue-wikipage-empty" or "smw-browse-invalid-subject" because SMW\Message does not seem to support sensible escaping of parameters such as MediaWiki's Message class' rawParam.

Examples

• Actions to take: https://gerrit.wikimedia.org/r/#/q/topic:esc+owner:Nikerabbit,n,z
• Docs: https://www.mediawiki.org/wiki/Manual:Messages_API#Output_modes_and_escaping

[kghbln]

@Nikerabbit On T85864 there is quite a long list of messages. Will it be easy to get a list for current master? Today e.g. SMWAdmin was redone and perhaps no longer has this issue.

[Nikerabbit]

I am running https://gerrit.wikimedia.org/r/#/c/203299/ myself now. I can update the list after some time. Due to the nature of how it works, what it finds is not comprehensive.

[kghbln]

Due to the nature of how it works, what it finds is not comprehensive.

I can believe that very well. The reason why I was timid when asking in the first place. :)

[Nikerabbit]

Some data, do note that some of these were fixed already.

      2 Unescaped message smw_browse_article
      5 Unescaped message smw_browse_go
     11 Unescaped message smw-browse-invalid-subject
     11 Unescaped message smw-datavalue-wikipage-empty
      3 Unescaped message smw_result_noresults
      2 Unescaped message smw_sbv_docu
      1 Unescaped message smw-sp-searchbyproperty-nonvaluequery
      1 Unescaped message smw-sp-searchbyproperty-valuequery

With regards to my earlier comment about the Message class: you don't have the ability of passing another Message as parameter to another Message and not have it double escaped. In MediaWiki you can do this with rawParam() and escaping both separately (and in master, it will do this automatically for you if you pass Message object).

[Nikerabbit]

Btw, now when I visit Special:Browse I get:

The subject validation returned with a "The wikipage input value is empty (e.g. <code>[[SomeProperty::]], [[]]</code>) and therefore it cannot be used as a name or as part of a query condition." error.

I don't think the <code> was supposed to be escaped here.

[aidaph]

Hi @Nikerabbit,

I've installed a local mediwaiki with the Semantic Mediawiki extension, version 2.5.1 (i think is the last release). When i type Special:Browse, appears the same message you have in the last message.

I don't know the reason of this issue and if i need to install another extension.

Kind regards and thank you,
Aida

[kghbln]

@Nikerabbit @aidaph Did not see your comments before. The issue with "Special:Browse" displaying a message instead of an input form is tracked with https://github.com/SemanticMediaWiki/SemanticMediaWiki/issues/2184