From 93cbb47cda644e06ce90ba1483ce76e03f13962a Mon Sep 17 00:00:00 2001 From: a smart kitten Date: Mon, 28 Apr 2025 14:42:23 +0100 Subject: [PATCH] SECURITY: Don't add the 'Recreated' tag if the target of a title's deletion log entry is hidden Why: - MediaWiki currently tags edits that create a new page at a previously-deleted title with 'Recreated', whether or not the target of the deletion log entry for that title has been hidden. - However, if the target of the log events relating to a title have been hidden, it is no longer publicly known that a page with that title used to exist. - Because of this, in a situation where a page is created at a title that has previously existed but has had the targets of its log events hidden, MediaWiki - in tagging the edit creating the new page with 'Recreated' - currently leaks the information that a page at that title has previously existed. What: - Added a condition to the database query in maybeAddRecreateChangeTag() so that it only matches deletion log entries that don't have a hidden target (LogPage::DELETED_ACTION). - Added a test case to check that edits are no longer tagged as 'Recreated' when the target of a title's deletion log entry has been hidden. - Modified existing tests to remove calls to ManualLogEntry::setDeleted(), and edited test titles for clarity. Bug: T385792 Change-Id: Ifb8299581e1162de35d5741b193610b09253bf9b --- includes/Storage/DerivedPageDataUpdater.php | 11 +++++- .../Storage/DerivedPageDataUpdaterTest.php | 38 ++++++++++++++++--- 2 files changed, 41 insertions(+), 8 deletions(-) diff --git a/includes/Storage/DerivedPageDataUpdater.php b/includes/Storage/DerivedPageDataUpdater.php index 83d68b30966..c66618a1ee0 100644 --- a/includes/Storage/DerivedPageDataUpdater.php +++ b/includes/Storage/DerivedPageDataUpdater.php @@ -40,6 +40,7 @@ use MediaWiki\HookContainer\HookRunner; use MediaWiki\JobQueue\JobQueueGroup; use MediaWiki\JobQueue\Jobs\ParsoidCachePrewarmJob; use MediaWiki\Language\Language; +use MediaWiki\Logging\LogPage; use MediaWiki\MainConfigNames; use MediaWiki\Page\Event\PageRevisionUpdatedEvent; use MediaWiki\Page\PageIdentity; @@ -1770,14 +1771,20 @@ class DerivedPageDataUpdater implements LoggerAwareInterface, PreparedUpdate { * @param int $revisionId */ private function maybeAddRecreateChangeTag( WikiPage $wikiPage, int $revisionId ) { - if ( $this->loadbalancerFactory->getReplicaDatabase()->newSelectQueryBuilder() + $replicaDB = $this->loadbalancerFactory->getReplicaDatabase(); + + if ( $replicaDB->newSelectQueryBuilder() ->select( [ '1' ] ) ->from( 'logging' ) ->where( [ 'log_type' => 'delete', 'log_title' => $wikiPage->getTitle()->getDBkey(), 'log_namespace' => $wikiPage->getNamespace(), - ] )->caller( __METHOD__ )->limit( 1 )->fetchField() ) { + ] ) + ->where( + $replicaDB->bitAnd( 'log_deleted', LogPage::DELETED_ACTION ) . + ' != ' . LogPage::DELETED_ACTION // T385792 + )->caller( __METHOD__ )->limit( 1 )->fetchField() ) { $this->changeTagsStore->addTags( [ ChangeTags::TAG_RECREATE ], null, diff --git a/tests/phpunit/includes/Storage/DerivedPageDataUpdaterTest.php b/tests/phpunit/includes/Storage/DerivedPageDataUpdaterTest.php index 4ed90c11947..24c18e2e19a 100644 --- a/tests/phpunit/includes/Storage/DerivedPageDataUpdaterTest.php +++ b/tests/phpunit/includes/Storage/DerivedPageDataUpdaterTest.php @@ -1390,7 +1390,7 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { * @covers \MediaWiki\Storage\DerivedPageDataUpdater::doUpdates() * @covers \MediaWiki\Storage\DerivedPageDataUpdater::maybeAddRecreateChangeTag */ - public function testDoUpdatesTagsEditAsRecreatedWhenDeletedLogEntry() { + public function testDoUpdatesTagsEditAsRecreatedWhenDeletionLogEntry() { $page = $this->getPage( __METHOD__ ); $title = $this->getTitle( __METHOD__ ); @@ -1400,7 +1400,6 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { $deleteLogEntry = new ManualLogEntry( 'delete', 'delete' ); $deleteLogEntry->setPerformer( $this->getTestUser()->getUser() ); $deleteLogEntry->setTarget( $title ); - $deleteLogEntry->setDeleted( LogPage::DELETED_ACTION ); $logId = $deleteLogEntry->insert( $this->getDb() ); $deleteLogEntry->publish( $logId ); @@ -1426,7 +1425,6 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { $deleteLogEntry = new ManualLogEntry( 'delete', 'delete' ); $deleteLogEntry->setPerformer( $this->getTestUser()->getUser() ); $deleteLogEntry->setTarget( $title ); - $deleteLogEntry->setDeleted( LogPage::DELETED_ACTION ); $logId = $deleteLogEntry->insert( $this->getDb() ); $deleteLogEntry->publish( $logId ); @@ -1440,7 +1438,7 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { * @covers \MediaWiki\Storage\DerivedPageDataUpdater::doUpdates() * @covers \MediaWiki\Storage\DerivedPageDataUpdater::maybeAddRecreateChangeTag */ - public function testDoUpdatesTagsEditAsRecreatedWhenDeletedLogEntryAndUndelete() { + public function testDoUpdatesDoesNotTagEditAsRecreatedWhenDeletionLogEntryAndUndelete() { $page = $this->getPage( __METHOD__ ); $title = $this->getTitle( __METHOD__ ); $user = $this->getMutableTestUser()->getUser(); @@ -1459,7 +1457,6 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { $deleteLogEntry = new ManualLogEntry( 'delete', 'delete' ); $deleteLogEntry->setPerformer( $this->getTestUser()->getUser() ); $deleteLogEntry->setTarget( $title ); - $deleteLogEntry->setDeleted( LogPage::DELETED_ACTION ); $logId = $deleteLogEntry->insert( $this->getDb() ); $deleteLogEntry->publish( $logId ); // undelete the page @@ -1475,7 +1472,7 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { * @covers \MediaWiki\Storage\DerivedPageDataUpdater::doUpdates() * @covers \MediaWiki\Storage\DerivedPageDataUpdater::maybeAddRecreateChangeTag */ - public function testDoUpdatesDoesNotTagEditAsRecreatedWhenNoDeletedLogEntry() { + public function testDoUpdatesDoesNotTagEditAsRecreatedWhenNoDeletionLogEntry() { $page = $this->getPage( __METHOD__ ); $content = [ SlotRecord::MAIN => new WikitextContent( 'rev ID ver #1: {{REVISIONID}}' ) ]; @@ -1485,6 +1482,35 @@ class DerivedPageDataUpdaterTest extends MediaWikiIntegrationTestCase { $this->getDb(), null, $rev->getId() ) ); } + /** + * See T385792 + * + * @covers \MediaWiki\Storage\DerivedPageDataUpdater::doUpdates() + * @covers \MediaWiki\Storage\DerivedPageDataUpdater::maybeAddRecreateChangeTag + */ + public function testDoUpdatesDoesNotTagEditAsRecreatedWhenDeletionLogEntryActionHidden() { + $page = $this->getPage( __METHOD__ ); + $title = $this->getTitle( __METHOD__ ); + + $content = [ SlotRecord::MAIN => new WikitextContent( 'rev ID ver #1: {{REVISIONID}}' ) ]; + + // create a deletion log entry + $deleteLogEntry = new ManualLogEntry( 'delete', 'delete' ); + $deleteLogEntry->setPerformer( $this->getTestUser()->getUser() ); + $deleteLogEntry->setTarget( $title ); + + // hide the target of the deletion log entry + $deleteLogEntry->setDeleted( LogPage::DELETED_ACTION ); + + $logId = $deleteLogEntry->insert( $this->getDb() ); + $deleteLogEntry->publish( $logId ); + + $rev = $this->createRevision( $page, 'first', $content ); + + $this->assertSame( [], $this->getServiceContainer()->getChangeTagsStore()->getTags( + $this->getDb(), null, $rev->getId() ) ); + } + public static function provideEnqueueRevertedTagUpdateJob() { return [ 'not patrolled' => [ true, 0, 0 ], -- 2.43.0