⚓ T297386 TemplateData doesn't fully validate suggestedvalues
Page MenuHomePhabricator

TemplateData doesn't fully validate suggestedvalues
Closed, ResolvedPublicBUG REPORT

Description

The suggestedvalues feature in TemplateData is currently not properly validated. It must be an array. But the values can be anything. Example:

"suggestedvalues": [
    "string, as expected",
    { "value": "well…",}
]

This is successfully stored and returned by the API as is. VisualEditor doesn't fail immediately, but behaves odd.

Event Timeline

Change 745543 had a related patch set uploaded (by Thiemo Kreuz (WMDE); author: Thiemo Kreuz (WMDE)):

[mediawiki/extensions/VisualEditor@master] Skip bad suggestedvalues in the template dialog

https://gerrit.wikimedia.org/r/745543

Change 745544 had a related patch set uploaded (by Thiemo Kreuz (WMDE); author: Thiemo Kreuz (WMDE)):

[mediawiki/extensions/TemplateData@master] Add missing validation for aliases and suggestedvalues

https://gerrit.wikimedia.org/r/745544

FYI, I just checked both enwiki and dewiki if there is any template using anything but an array of strings. It looks like there are none. There is the custom JSON format on dewiki that is processes by Template:TemplateData, but that's guaranteed to output the correct format.

Change 745544 merged by jenkins-bot:

[mediawiki/extensions/TemplateData@master] Add missing validation for aliases and suggestedvalues

https://gerrit.wikimedia.org/r/745544

Change 745543 merged by jenkins-bot:

[mediawiki/extensions/VisualEditor@master] Skip bad suggestedvalues and aliases in the template dialog

https://gerrit.wikimedia.org/r/745543

Note: when opening a legacy broken suggestedvalue e.g. with a raw integer 3, an empty pill appears where the entry should be. No warning appears. Saving the template data will silently replace the broken value with a null.

Change 751488 had a related patch set uploaded (by Thiemo Kreuz (WMDE); author: Thiemo Kreuz (WMDE)):

[mediawiki/extensions/TemplateData@master] Don't feed bad values to TagMultiselectWidget

https://gerrit.wikimedia.org/r/751488

[…] an empty pill appears […] Saving the template data will silently replace the broken value with a null.

Nice find! Even with all validation in place it's possible to run into this. Just add "suggestedvalues": [ 3 ] manually to the JSON, don't save the page, but start the TemplateData editor.

I uploaded a quick patch that makes the editor behave less broken in such a situation.

Change 751749 had a related patch set uploaded (by Thiemo Kreuz (WMDE); author: Thiemo Kreuz (WMDE)):

[oojs/ui@master] Fix TagMultiselectWidget.setValue behaving odd in edge cases

https://gerrit.wikimedia.org/r/751749

Change 751749 merged by jenkins-bot:

[oojs/ui@master] Fix TagMultiselectWidget.setValue behaving odd in edge cases

https://gerrit.wikimedia.org/r/751749

Change 751488 abandoned by Thiemo Kreuz (WMDE):

[mediawiki/extensions/TemplateData@master] Don't feed bad values to TagMultiselectWidget

Reason:

Done as part of I32ea296.

https://gerrit.wikimedia.org/r/751488

Change 753557 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/core@master] Update OOUI to v0.43.0

https://gerrit.wikimedia.org/r/753557

Change 753557 merged by jenkins-bot:

[mediawiki/core@master] Update OOUI to v0.43.0

https://gerrit.wikimedia.org/r/753557