Last modified: 2013-11-23 00:18:08 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T23602, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 21602 - Code review for use of SMW in MediaWiki.Org
Code review for use of SMW in MediaWiki.Org
Status: RESOLVED WONTFIX
Product: MediaWiki extensions
Classification: Unclassified
Semantic MediaWiki (Other open bugs)
unspecified
All All
: Normal enhancement (vote)
: ---
Assigned To: Markus Krötzsch
http://MediaWiki.Org
:
Depends on:
Blocks: 31235
  Show dependency treegraph
 
Reported: 2009-11-23 09:38 UTC by Dan Bolser
Modified: 2013-11-23 00:18 UTC (History)
10 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Dan Bolser 2009-11-23 09:38:20 UTC
The idea is to use SMW to manage MediaWiki extensions. The associated email discussion that took place on semediawiki-user@lists.sourceforge.net is included below.

The requirement for including an extension in http://MediaWiki.Org is that it gets a code review from a MW staffer (i.e. TimStarling). However, it seems that before he looks at the code, it should be rewritten to conform to the security guidelines spelled out on http://MediaWiki.Org:

http://www.mediawiki.org/wiki/Manual:Security
http://www.mediawiki.org/wiki/Security_for_developers


This bug is to track the status of that rewrite, specifically for the SMW core code. We can create dependent bugs for the SF / SD / SRF / etc. extensions. I think the best approach is to work on one extension at a time, starting with SMW core.





More information:

For example, Tim found a problem in the SF extension (an XSS vulnerability in Special:CreateForm):

He created a template called:

  Template:" onclick="alert('hello');" foo=


and when called from within the combo box of Special:CreateForm, it did just that!



Email discussion:

2009/11/20 Laurent Alquier <laurent@alquier.org>:
> I had an idea last night to help make SMW more visible.
>
> Use SMW to manage MediaWiki extensions.
>
> The current list of extensions is a mess. There is no way to query them at all. The lists on the index page are static and (I hope) updated by a script.
>
> They already use an 'Extension' template. How hard could it be to set up SMW + forms on the MediaWiki site and replace the 'Extension' template with a semantic template?


2009/11/22 Jan Steinman <Jan@bytesmiths.com>:
> Yes!
>
> Whenever I think, "Someone must have already done an extension for
> this thing I want to do," I get depressed at the hours of work it will
> take for me to tease it out.


2009/11/22 Krabina Bernhard <krabina@kdz.or.at>:
> that's an excellent idea!!



IRC discussion:

17:22 < faceface> hi RoanKattouw 
17:22 < faceface> on the Semantic MediaWiki mailing list the discussion about 
                  potentially running SMW on mediawiki.org just came up
17:23 < faceface> do you think it would be a possibility to run SMW on MW.org?
17:23 < RoanKattouw> For that to happen it would first have to be reviewed by a 
                     staff member
17:23 < RoanKattouw> In practice, that means Tim
17:24 < RoanKattouw> Reviewing SMW is not something you do on a rainy Sunday 
                     night
17:24 < RoanKattouw> faceface: I mean reviewing the actual code
17:24 < RoanKattouw> Which I imagine is pretty large
17:25 < faceface> A code review would be really welcome though
17:25 < faceface> what could SMW devs do to make it easier?
17:26 < RoanKattouw> Well not much I guess, they can hardly review their own 
                     code
17:26 < RoanKattouw> They could verify that all the DB queries SMW runs are 
                     properly indexed, you know, run EXPLAIN on them

...

<TimStarling> faceface_: I just opened the source of a random special
page and found an XSS vulnerability in about 10 seconds
<TimStarling> it's persistent:
http://www.bioinformatics.org/wiki/Special:CreateForm
<Platonides> I see the " onclick="alert("hello"); inside the combo
<TimStarling> it works as advertised
<Platonides> at last
<Platonides> the event wasn't firing

It seems like a waste of my time to review this thing when the quality
is so low and the errors are so obvious. Surely anyone could see those
sorts of things if they bothered to look. Maybe if it were rewritten to
conform with the security guidelines I've spelled out on mediawiki.org
then I'd be interested.

-- Tim Starling
Comment 1 Markus Krötzsch 2009-12-30 11:41:20 UTC
The SMW core developers are well aware of the guidelines at http://www.mediawiki.org/wiki/Security_for_developers and bugs in third-party extensions should not be mixed up with SMW. There is of course always a possibility of human error, and more should be done to make the SMW code more readable/reviewable.

The main tasks I see for this bug are:

* Organise independent code review by a developer who did not write SMW and generate an first assessment of readability/security based on this. Volunteers are welcome, but we will also proactively recruit some people to do this.
* Define which core features are actually required for the first SMW version to run on mediawiki.org. SMW is very modular, and features can be removed to reduce reviewing effort. I am not sure who to approach for this; maybe we should develop a proposal.
* Improve readability of the SQL access code. It is currently the longest piece of code (due to many similar but different ways of reading data of various types), and I see that it will be hardest to review.

The current structure of SMW's code and the associated lines of code can be seen at http://semantic-mediawiki.org/wiki/SMW_source_code_structure
Comment 2 Tim Starling 2009-12-31 01:10:45 UTC
I'm pretty sure my comment quoted above was in response to a request to review SemanticForms, I wasn't implying SMW is in the same boat.
Comment 3 Dan Bolser 2010-02-07 01:31:09 UTC
Some preliminary work to create a demonstration of the advantages of using SMW
to handle extensions was undertaken at the following SMW site:

http://extensions.referata.com/wiki/Main_Page


However, more work needs to be put into that site to make it a convincing
demonstration of the benefits of SMW.
Comment 4 Greg Grossmeier 2013-03-07 22:29:27 UTC
From my understanding of the current situation, this bug should be closed. If you believe this to be in error, you can blame me; the new guy.

Please pardon the noise.
Comment 5 Dan Bolser 2013-03-08 08:02:30 UTC
Yeah, it's a shame (I think SMW could be very useful on MW.Org, for example), but there is no concerted will in either community to do this.

Cheers,

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links