Page MenuHomePhabricator

[[|||||||||]|-|-]A|-/ in edit summary causes exception
Closed, ResolvedPublic

Description

Author: md_yosri

Description:
Screen print

Error message when access History >50:-

[324b0ea2] 2012-07-21 23:06:02: Fatal exception of type MWException

Problem on:-
Android, Windows
Browser:-
Dolfin, Chrome, IE6


Version: unspecified
Severity: major
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=41258
https://bugzilla.wikimedia.org/show_bug.cgi?id=41400

Attached:

FatalError.png (768×1 px, 170 KB)

Details

Reference
bz38566

Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 12:53 AM
bzimport added a project: MediaWiki-Parser.
bzimport set Reference to bz38566.
bzimport added a subscriber: Unknown Object (MLST).
  • Bug 38600 has been marked as a duplicate of this bug. ***

it happens for any limit higher than 630. I tested it.

Trying with the api, i think its probably this edit (might have got the offset wrong, so might be wrong):

<rc type="edit" ns="14" title="Kategori:86 SM" rcid="2371588" pageid="278625" revid="2279068" old_revid="2112444" user="Xqbot" userid="40750" bot="" minor="" oldlen="955" newlen="965" timestamp="2012-07-22T22:44:56Z" comment="r2.7.3) (Bot: Menukar [[fr:Catégorie:-86]] kepada [[fr:Catégorie:86 av. J.-C.]]" parsedcomment="r2.7.3) (Bot: Menukar &lt;a href=&quot;//fr.wikipedia.org/wiki/Cat%C3%A9gorie:-86&quot; class=&quot;extiw&quot; title=&quot;fr:Catégorie:-86&quot;&gt;fr:Catégorie:-86&lt;/a&gt; kepada &lt;a href=&quot;//fr.wikipedia.org/wiki/Cat%C3%A9gorie:86_av._J.-C.&quot; class=&quot;extiw&quot; title=&quot;fr:Catégorie:86 av. J.-C.&quot;&gt;fr:Catégorie:86 av. J.-C.&lt;/a&gt;">
  <tags />
</rc>

Nothing seems especially out of the ordinary from the api output

(If i was on my normal computer, I'd just look at the toolserver which would probably yield better info...)

I dug up the error plus backtrace in the logs, see below. The bad change seems to be rcid 2369742 (also dumped below), but I don't understand why. The backtrace implies something is wrong with the $this->params member of the Message object, but since it's just doing wfMessage('parentheses')->rawParams($formatted)->escaped(); where $formatted is the result of Linker::formatComment(), I don't see how it would get messed up.

CC Niklas because the exception occurs deep in the bowels of Message.php

<rc type="new" ns="10" title="Templat:IPAc-cmn" rcid="2369742" pageid="341526" revid="2277275" old_revid="0" timestamp="2012-07-21T14:42:08Z" />

mysql> select * from recentchanges where rc_id=2369742 \G

  • 1. row ******* rc_id: 2369742 rc_timestamp: 20120721144208 rc_cur_time: 20120721144208 rc_user: 72824 rc_user_text: 26 Ramadan rc_namespace: 10 rc_title: IPAc-cmn rc_comment: Mencipta laman baru dengan kandungan '<includeonly><span class="IPA" style="white-space:nowrap">[[Wikipedia:IPA untuk Mandarin|{{#switch:{{{1}}}|[-|[]|[]AUD=[|/-||AUD=/|--|-]|-/|-]AUD|-/AUD=...' rc_minor: 0 rc_bot: 0 rc_new: 1 rc_cur_id: 341526 rc_this_oldid: 2277275 rc_last_oldid: 0 rc_type: 1 rc_moved_to_ns: 0

rc_moved_to_title:

 rc_patrolled: 0
        rc_ip: CENSORED
   rc_old_len: 0
   rc_new_len: 5510
   rc_deleted: 0
     rc_logid: 0
  rc_log_type: NULL
rc_log_action:
    rc_params:

1 row in set (0.00 sec)

2012-07-23 22:36:31 srv234 mswiki: [7ce45821] /w/index.php?title=Khas:Perubahan_terkini&limit=686 Exception from line 571 of /usr/local/apache/common-local/php-1.20wmf7/includes/Message.php: Invalid message parameter
#0 /usr/local/apache/common-local/php-1.20wmf7/includes/Message.php(546): Message->extractParam(Array)
#1 /usr/local/apache/common-local/php-1.20wmf7/includes/Message.php(414): Message->replaceParameters('($1)', 'before')
#2 /usr/local/apache/common-local/php-1.20wmf7/includes/Message.php(491): Message->toString()
#3 /usr/local/apache/common-local/php-1.20wmf7/includes/Linker.php(1456): Message->escaped()
#4 /usr/local/apache/common-local/php-1.20wmf7/includes/ChangesList.php(435): Linker::commentBlock('Mencipta laman ...', Object(Title))
#5 /usr/local/apache/common-local/php-1.20wmf7/includes/ChangesList.php(640): ChangesList->insertComment(Object(RecentChange))
#6 /usr/local/apache/common-local/php-1.20wmf7/includes/specials/SpecialRecentchanges.php(527): OldChangesList->recentChangesLine(Object(RecentChange), false, 687)
#7 /usr/local/apache/common-local/php-1.20wmf7/includes/specials/SpecialRecentchanges.php(179): SpecialRecentChanges->webOutput(Object(ResultWrapper), Object(FormOptions))
#8 /usr/local/apache/common-local/php-1.20wmf7/includes/SpecialPage.php(611): SpecialRecentChanges->execute(NULL)
#9 /usr/local/apache/common-local/php-1.20wmf7/includes/SpecialPageFactory.php(493): SpecialPage->run(NULL)
#10 /usr/local/apache/common-local/php-1.20wmf7/includes/Wiki.php(263): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))
#11 /usr/local/apache/common-local/php-1.20wmf7/includes/Wiki.php(601): MediaWiki->performRequest()
#12 /usr/local/apache/common-local/php-1.20wmf7/includes/Wiki.php(511): MediaWiki->main()
#13 /usr/local/apache/common-local/php-1.20wmf7/index.php(58): MediaWiki->run()
#14 /usr/local/apache/common-local/live-1.5/index.php(3): require('/usr/local/apac...')
#15 {main}

Not just RC: http://ms.wikipedia.org/w/index.php?title=Templat:IPAc-cmn&action=history gives [2d7f7a89] 2012-07-24 13:27:11: Fatal exception of type MWException

Ok, so this is weird. Possibly something messed with parser.

Go edit a page (doesn't matter what lang, testing on ms and en).

In the edit summary, type the following:

[[|||||||||]|-|-]A|-/

Hit preview. I get [41f2ddc1] 2012-07-24 13:42:10: Fatal exception of type MWException.

Note however, that everything is fine on special:expandtemplates. Exception only happens in edit summary. Also of interest is that http://ms.wikipedia.org/w/api.php?action=parse&summary=[[|||||||||]|-|-]A|-/&text=foo errors out too

The problem is in

Linker::formatLinksInComment:

		$html = preg_replace_callback(
			'/\[\[:?(.*?)(\|(.*?))*\]\]([^[]*)/',
			array( 'Linker', 'formatLinksInCommentCallback' ),
			$comment );

preg_replace_callback encounters PREG_BACKTRACK_LIMIT_ERROR and returns null.

This is later on passed to wfMessage( ... )->rawParams( $html )->foo();

Message class checks

		if ( is_array( $param ) && isset( $param['raw'] ) ) {

But since it is array( 'raw' => null ); isset returns false and exception is raised.

Could @Niklas or @Roan submit a patch to fix this? Or are there non-trivial problems involved that may require broader refactoring?

I'm not regular expression expert, one is needed to optimize or workaround this one.

Well for now we could just do if ( $html == null ) $html = $thingyBeforeWeTriedToParseIt In very very rare cases comments wouldn't have wikilinks formatted. Given the rarity of this happening I don't think its something that really matters.

Would the following regexp work?

\[\[:?([^\|\]\n]*?)(\|([^\|\]\n]*?))*\]\]([^[]*)

I've basically replaced every "." ("any character except for newline") with "[^\|\]\n]" ("any character except for |, ] or newline"). This prevents catastrophic backtracking[1].

[1] http://www.regular-expressions.info/catastrophic.html

  • Bug 42432 has been marked as a duplicate of this bug. ***
  • Bug 41400 has been marked as a duplicate of this bug. ***

Fixed by the patch for bug 41400. Closing.

  • Bug 41258 has been marked as a duplicate of this bug. ***