mediawiki-extensions-Echo/tests/phpunit/integration/EventIntegrationTest.php
Matěj Suchánek 11b9e66f9f Disallow anonymous non-IP agents, handle truncated names
Why:
* Echo stores agents by their user id or by the name if the user
  is not registered. This works for IPs since the "event_agent_ip"
  field has limit of 39 bytes (32× [0-9A-F] + 7× colon for IPv6).
* However, it's possible to hold a user identity that is not
  an IP address, but the user name has not been or cannot be
  registered (e.g., external users). Echo wouldn't validate this
  and would attempt to insert the user name into "event_agent_ip",
  possibly causing silent truncation and data corruption.

What:
* Do not let events with such agents be saved. For now, log an
  error in the production. Wikibase, the only known source of this
  problem, has already been fixed.
* In runtime, replace every possibly corrupted user name with
  a placeholder to avoid unexpected null values and exceptions
  in production.

Bug: T367638
Change-Id: Ic2bd218b10651d13da9e9aea54dd2d668a33d946
Depends-On: I03b4367355dc5a3fc0c14aad5fdf19fbcd0caa3d
Depends-On: I92eb93983e81708b289e9f7d837884d539dade0b
2024-11-14 11:44:19 +01:00

98 lines
2.8 KiB
PHP

<?php
use MediaWiki\Extension\Notifications\Mapper\EventMapper;
use MediaWiki\Extension\Notifications\Model\Event;
use MediaWiki\User\UserIdentityValue;
/**
* @covers \MediaWiki\Extension\Notifications\Model\Event
* @covers \MediaWiki\Extension\Notifications\Controller\NotificationController
* @covers \MediaWiki\Extension\Notifications\Jobs\NotificationJob
* @group Database
*/
class EventIntegrationTest extends MediaWikiIntegrationTestCase {
public function testEventInsertionImmediate() {
$this->clearHook( 'BeforeEchoEventInsert' );
$this->overrideConfigValue( 'EchoUseJobQueue', false );
$user = $this->getTestUser()->getUser();
$event = Event::create( [
'type' => 'welcome',
'agent' => $user,
'extra' => [ 'key' => 'value' ]
] );
$eventId = $event->getId();
$this->assertNotFalse( $eventId );
$this->assertSame( $eventId, $event->acquireId() );
$this->assertSelect(
'echo_event',
[ 'count' => 'COUNT(*)' ],
[ 'event_type' => 'welcome' ],
[ [ '1' ] ]
);
}
public function testEventNotInserted() {
$this->clearHook( 'BeforeEchoEventInsert' );
$this->overrideConfigValue( 'EchoUseJobQueue', false );
$event = Event::create( [
'type' => 'welcome',
// anons cannot be notified
'agent' => UserIdentityValue::newAnonymous( '1.2.3.4' ),
'extra' => [ 'key' => 'value' ]
] );
$this->assertFalse( $event->getId() );
$this->assertSelect(
'echo_event',
[ 'count' => 'COUNT(*)' ],
[ 'event_type' => 'welcome' ],
[ [ '0' ] ]
);
}
public function testEventNotCreatedForUnknownUser() {
$this->clearHook( 'BeforeEchoEventInsert' );
$event = Event::create( [
'type' => 'welcome',
'agent' => UserIdentityValue::newAnonymous( 'Anonymous user' ),
] );
$this->assertFalse( $event );
}
public function testEventInsertionDeferred() {
$this->clearHook( 'BeforeEchoEventInsert' );
$this->clearHook( 'PageSaveComplete' );
$this->overrideConfigValue( 'EchoUseJobQueue', true );
$user = $this->getTestUser()->getUser();
$title = $this->getExistingTestPage()->getTitle();
$this->runJobs();
$event = Event::create( [
'type' => 'welcome',
'agent' => $user,
'title' => $title,
'extra' => [ 'key' => 'value' ]
] );
$this->assertFalse( $event->getId() );
unset( $event );
$jobQueueGroup = $this->getServiceContainer()->getJobQueueGroup();
$queues = $jobQueueGroup->getQueuesWithJobs();
$this->assertSame( [ 'EchoNotificationJob' ], $queues );
$job = $jobQueueGroup->pop( 'EchoNotificationJob' );
$job->run();
$eventMapper = new EventMapper();
$events = $eventMapper->fetchByPage( $title->getArticleID() );
$this->assertCount( 1, $events );
[ $event ] = $events;
$this->assertSame( 'welcome', $event->getType() );
$this->assertTrue( $user->equals( $event->getAgent() ) );
}
}