Anomie has uploaded a new change for review.

  https://gerrit.wikimedia.org/r/315704

Change subject: Avoid blowing up inside Parser::extensionSubstitution() when PP 
limits are exceeded
......................................................................

Avoid blowing up inside Parser::extensionSubstitution() when PP limits are 
exceeded

The most critical one is if the marker name is bad, since that causes
StripState to throw an exception since I798d31af. But we may as well
check the other expand calls in this function too to avoid outputting
broken wikitext.

Bug: T136401
Change-Id: I1cb353d74f9a46168055e1abeb22cf569fe9354a
---
M includes/parser/Parser.php
1 file changed, 23 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core 
refs/changes/04/315704/1

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index a32acc2..f0898ba 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -3784,9 +3784,28 @@
         * @return string
         */
        public function extensionSubstitution( $params, $frame ) {
+               static $errorStr = '<span class="error">';
+               static $errorLen = 20;
+
                $name = $frame->expand( $params['name'] );
+               if ( substr( $name, 0, $errorLen ) === $errorStr ) {
+                       // Probably expansion depth or node count exceeded. 
Just punt the
+                       // error up.
+                       return $name;
+               }
+
                $attrText = !isset( $params['attr'] ) ? null : $frame->expand( 
$params['attr'] );
+               if ( substr( $attrText, 0, $errorLen ) === $errorStr ) {
+                       // See above
+                       return $attrText;
+               }
+
                $content = !isset( $params['inner'] ) ? null : $frame->expand( 
$params['inner'] );
+               if ( substr( $content, 0, $errorLen ) === $errorStr ) {
+                       // See above
+                       return $content;
+               }
+
                $marker = self::MARKER_PREFIX . "-$name-"
                        . sprintf( '%08X', $this->mMarkerIndex++ ) . 
self::MARKER_SUFFIX;
 
@@ -3844,6 +3863,10 @@
                                $output = "<$name$attrText/>";
                        } else {
                                $close = is_null( $params['close'] ) ? '' : 
$frame->expand( $params['close'] );
+                               if ( substr( $close, 0, $errorLen ) === 
$errorStr ) {
+                                       // See above
+                                       return $close;
+                               }
                                $output = "<$name$attrText>$content$close";
                        }
                }

-- 
To view, visit https://gerrit.wikimedia.org/r/315704
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I1cb353d74f9a46168055e1abeb22cf569fe9354a
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Anomie <bjor...@wikimedia.org>

_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to