diff --git a/includes/parser/AbuseFilterCachingParser.php b/includes/parser/AbuseFilterCachingParser.php index 40bfb0572..27bf96fe0 100644 --- a/includes/parser/AbuseFilterCachingParser.php +++ b/includes/parser/AbuseFilterCachingParser.php @@ -171,6 +171,9 @@ class AbuseFilterCachingParser extends AbuseFilterParser { list( $array, $offset ) = $node->children; $array = $this->evalNode( $array ); + // Note: we MUST evaluate the offset to ensure it is valid, regardless + // of $array! + $offset = $this->evalNode( $offset )->toInt(); if ( $array->getType() === AFPData::DUNDEFINED ) { return new AFPData( AFPData::DUNDEFINED ); @@ -180,8 +183,6 @@ class AbuseFilterCachingParser extends AbuseFilterParser { throw new AFPUserVisibleException( 'notarray', $node->position, [] ); } - $offset = $this->evalNode( $offset )->toInt(); - $array = $array->toArray(); if ( count( $array ) <= $offset ) { throw new AFPUserVisibleException( 'outofbounds', $node->position, diff --git a/tests/phpunit/unit/AbuseFilterParserTest.php b/tests/phpunit/unit/AbuseFilterParserTest.php index c4dd1343d..072893821 100644 --- a/tests/phpunit/unit/AbuseFilterParserTest.php +++ b/tests/phpunit/unit/AbuseFilterParserTest.php @@ -301,6 +301,8 @@ class AbuseFilterParserTest extends AbuseFilterParserTestCase { [ 'a[1] := 5', 'getVarValue' ], [ 'a[] := 5', 'getVarValue' ], [ 'a = 5', 'getVarValue' ], + [ 'timestamp[a]', 'getVarValue' ], + [ 'x := []; x[a] := 1', 'getVarValue' ], ]; }