Last modified: 2014-08-22 10:31:44 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T71893, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 69893 - MMV: Page is completely blacked out when accessing an invalid file name
MMV: Page is completely blacked out when accessing an invalid file name
Status: NEW
Product: MediaWiki extensions
Classification: Unclassified
MultimediaViewer (Other open bugs)
unspecified
All All
: Unprioritized major (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-08-22 10:31 UTC by Krinkle
Modified: 2014-08-22 10:31 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Krinkle 2014-08-22 10:31:44 UTC
Urls like,

 https://en.wikipedia.org/wiki/Mike_Godwin#mediaviewer/File:T<ess.pdf

Result in a completely black page with discoverable way to get out and no commmunication as to what happened.

The console shows:

Uncaught Error: Unable to parse title VM299:35
 Title VM299:35
 RP.parseHash
 RP.parseLocation VM320:90
 MMVP.hash VM320:103
 deferred
 MMVB.isCSSReady

Presumably there is an instance of `new mw.Title` where it should use mw.Title.newFromText with a condition check to verify the title was not invalid. It is user input after all, and even if it would try to match the DOM element first, the DOM can also contain arbitrary elements that are made to look like mediawiki image frames, and in addition, title validation rules can change over time, and in addition, the js class is only an approximation to the sever-side variant. There's always a risk of it being looser or stricter, so always validate titles (unless maybe they come from the API or an mw.config value directly).

The page being completely black is more common actually, since it's the standard thing that happens if there's an uncaught exception anywhere. Looks like maybe the UI and logic aren't separated properly that it causes the UI to get stuck half-way when it's doing what looks like simple logic. It should probably set up more of the UI at once (e.g. don't put up a black dimmer without also, in the same atomic dom change, provide a way to get out of it).

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links