Various fixes to make phan-taint-check happier

Bug: T216348
Change-Id: If4071e689f476d2138d8964598c5a02b09448677

diff --git a/includes/Linker.php b/includes/Linker.php
index 049fb07..2c7f44c 100644 (file)
--- a/includes/Linker.php
+++ b/includes/Linker.php
@@ -112,7 +112,7 @@ class Linker {
                if ( $html !== null ) {
                        $text = new HtmlArmor( $html );
                } else {
-                       $text = $html; // null
+                       $text = null;
                }
 
                if ( in_array( 'known', $options, true ) ) {
@@ -823,13 +823,20 @@ class Linker {
 
        /**
         * Make an external link
+        *
         * @since 1.16.3. $title added in 1.21
         * @param string $url URL to link to
+        * @param-taint $url escapes_html
         * @param string $text Text of link
+        * @param-taint $text escapes_html
         * @param bool $escape Do we escape the link text?
+        * @param-taint $escape none
         * @param string $linktype Type of external link. Gets added to the classes
+        * @param-taint $linktype escapes_html
         * @param array $attribs Array of extra attributes to <a>
+        * @param-taint $attribs escapes_html
         * @param Title|null $title Title object used for title specific link attributes
+        * @param-taint $title none
         * @return string
         */
        public static function makeExternalLink( $url, $text, $escape = true,

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 461df94..0695443 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -953,6 +953,8 @@ class OutputPage extends ContextSource {
         * good tags like \<i\> will be dropped entirely.
         *
         * @param string|Message $name
+        * @param-taint $name tainted
+        * Phan-taint-check gets very confused by $name being either a string or a Message
         */
        public function setPageTitle( $name ) {
                if ( $name instanceof Message ) {
@@ -966,7 +968,7 @@ class OutputPage extends ContextSource {
 
                # change "<i>foo&amp;bar</i>" to "foo&bar"
                $this->setHTMLTitle(
-                       $this->msg( 'pagetitle' )->rawParams( Sanitizer::stripAllTags( $nameWithTags ) )
+                       $this->msg( 'pagetitle' )->plaintextParams( Sanitizer::stripAllTags( $nameWithTags ) )
                                ->inContentLanguage()
                );
        }

diff --git a/includes/api/ApiFormatPhp.php b/includes/api/ApiFormatPhp.php
index 45bdb6d..616b341 100644 (file)
--- a/includes/api/ApiFormatPhp.php
+++ b/includes/api/ApiFormatPhp.php
@@ -30,6 +30,9 @@ class ApiFormatPhp extends ApiFormatBase {
                return 'application/vnd.php.serialized';
        }
 
+       /**
+        * @suppress SecurityCheck-XSS Output type is not text/html
+        */
        public function execute() {
                $params = $this->extractRequestParams();