maintenance/fuzz-tester.php

   1 <?php
   2 /**
   3 * @file
   4 * @ingroup Maintenance
   5 * @author Nick Jenkins ( http://nickj.org/ ).
   6 * @copyright 2006 Nick Jenkins
   7 * @licence GNU General Public Licence 2.0
   8
   9 Started: 18 May 2006.
  10
  11 Description:
  12   Performs fuzz-style testing of MediaWiki's parser and forms.
  13
  14 How:
  15   - Generate lots of nasty wiki text.
  16   - Ask the Parser to render that wiki text to HTML, or ask MediaWiki's forms
  17         to deal with that wiki text.
  18   - Check MediaWiki's output for problems.
  19   - Repeat.
  20
  21 Why:
  22   - To help find bugs.
  23   - To help find security issues, or potential security issues.
  24
  25 What type of problems are being checked for:
  26   - Unclosed tags.
  27   - Errors or interesting warnings from Tidy.
  28   - PHP errors / warnings / notices.
  29   - MediaWiki internal errors.
  30   - Very slow responses.
  31   - No response from apache.
  32   - Optionally checking for malformed HTML using the W3C validator.
  33
  34 Background:
  35   Many of the wikiFuzz class methods are a modified PHP port,
  36   of a "shameless" Python port, of LCAMTUF'S MANGELME:
  37   - http://www.securiteam.com/tools/6Z00N1PBFK.html
  38   - http://www.securityfocus.com/archive/1/378632/2004-10-15/2004-10-21/0
  39
  40 Video:
  41   There's an XviD video discussing this fuzz tester. You can get it from:
  42   http://files.nickj.org/MediaWiki/Fuzz-Testing-MediaWiki-xvid.avi
  43
  44 Requirements:
  45   To run this, you will need:
  46   - Command-line PHP5, with PHP-curl enabled (not all installations have this
  47         enabled - try "apt-get install php5-curl" if you're on Debian to install).
  48   - the Tidy standalone executable. ("apt-get install tidy").
  49
  50 Optional:
  51   - If you want to run the curl scripts, you'll need standalone curl installed
  52         ("apt-get install curl")
  53   - For viewing the W3C validator output on a command line, the "html2text"
  54         program may be useful ("apt-get install html2text")
  55
  56 Saving tests and test results:
  57   Any of the fuzz tests which find problems are saved for later review.
  58   In order to help track down problems, tests are saved in a number of
  59   different formats. The default filename extensions and their meanings are:
  60   - ".test.php" : PHP script that reproduces just that one problem using PHP-Curl.
  61   - ".curl.sh"  : Shell script that reproduces that problem using standalone curl.
  62   - ".data.bin" : The serialized PHP data so that this script can re-run the test.
  63   - ".info.txt" : A human-readable text file with details of the field contents.
  64
  65 Wiki configuration for testing:
  66   You should make some additions to LocalSettings.php in order to catch the most
  67   errors. Note this configuration is for **TESTING PURPOSES ONLY**, and is IN NO
  68   WAY, SHAPE, OR FORM suitable for deployment on a hostile network. That said,
  69   personally I find these additions to be the most helpful for testing purposes:
  70
  71   // --------- Start ---------
  72   // Everyone can do everything. Very useful for testing, yet useless for deployment.
  73   $wgGroupPermissions['*']['autoconfirmed']   = true;
  74   $wgGroupPermissions['*']['block']           = true;
  75   $wgGroupPermissions['*']['bot']             = true;
  76   $wgGroupPermissions['*']['delete']          = true;
  77   $wgGroupPermissions['*']['deletedhistory']  = true;
  78   $wgGroupPermissions['*']['deleterevision']  = true;
  79   $wgGroupPermissions['*']['editinterface']   = true;
  80   $wgGroupPermissions['*']['hiderevision']    = true;
  81   $wgGroupPermissions['*']['import']          = true;
  82   $wgGroupPermissions['*']['importupload']    = true;
  83   $wgGroupPermissions['*']['minoredit']       = true;
  84   $wgGroupPermissions['*']['move']            = true;
  85   $wgGroupPermissions['*']['patrol']          = true;
  86   $wgGroupPermissions['*']['protect']         = true;
  87   $wgGroupPermissions['*']['proxyunbannable'] = true;
  88   $wgGroupPermissions['*']['renameuser']      = true;
  89   $wgGroupPermissions['*']['reupload']        = true;
  90   $wgGroupPermissions['*']['reupload-shared'] = true;
  91   $wgGroupPermissions['*']['rollback']        = true;
  92   $wgGroupPermissions['*']['siteadmin']       = true;
  93   $wgGroupPermissions['*']['trackback']       = true;
  94   $wgGroupPermissions['*']['unwatchedpages']  = true;
  95   $wgGroupPermissions['*']['upload']          = true;
  96   $wgGroupPermissions['*']['userrights']      = true;
  97   $wgGroupPermissions['*']['renameuser']      = true;
  98   $wgGroupPermissions['*']['makebot']         = true;
  99   $wgGroupPermissions['*']['makesysop']       = true;
 100
 101   // Enable weird and wonderful options:
 102                                                           // Increase default error reporting level.
 103   error_reporting (E_ALL);    // At a later date could be increased to E_ALL | E_STRICT
 104   $wgBlockOpenProxies = true; // Some block pages require this to be true in order to test.
 105   $wgEnableUploads = true;    // enable uploads.
 106   //$wgUseTrackbacks = true;  // enable trackbacks; However this breaks the viewPageTest, so currently disabled.
 107   $wgDBerrorLog = "/root/mediawiki-db-error-log.txt";  // log DB errors, replace with suitable path.
 108   $wgShowSQLErrors = true;    // Show SQL errors (instead of saying the query was hidden).
 109   $wgShowExceptionDetails = true;  // want backtraces.
 110   $wgEnableAPI = true;        // enable API.
 111   $wgEnableWriteAPI = true;   // enable API.
 112
 113   // Install & enable Parser Hook extensions to increase code coverage. E.g.:
 114   require_once("extensions/ParserFunctions/ParserFunctions.php");
 115   require_once("extensions/Cite/Cite.php");
 116   require_once("extensions/inputbox/inputbox.php");
 117   require_once("extensions/Sort/Sort.php");
 118   require_once("extensions/wikihiero/wikihiero.php");
 119   require_once("extensions/CharInsert/CharInsert.php");
 120   require_once("extensions/FixedImage/FixedImage.php");
 121
 122   // Install & enable Special Page extensions to increase code coverage. E.g.:
 123   require_once("extensions/Cite/SpecialCite.php");
 124   require_once("extensions/Filepath/SpecialFilepath.php");
 125   require_once("extensions/Makebot/Makebot.php");
 126   require_once("extensions/Makesysop/SpecialMakesysop.php");
 127   require_once("extensions/Renameuser/SpecialRenameuser.php");
 128   require_once("extensions/LinkSearch/LinkSearch.php");
 129   // --------- End ---------
 130
 131   If you want to try E_STRICT error logging, add this to the above:
 132   // --------- Start ---------
 133   error_reporting (E_ALL | E_STRICT);
 134   set_error_handler( 'error_handler' );
 135   function error_handler ($type, $message, $file=__FILE__, $line=__LINE__) {
 136          if ($message == "var: Deprecated. Please use the public/private/protected modifiers") return;
 137          print "<br />\n<b>Strict Standards:</b> Type: <b>$type</b>:  $message in <b>$file</b> on line <b>$line</b><br />\n";
 138   }
 139   // --------- End ---------
 140
 141   Also add/change this in LocalSettings.php:
 142   // --------- Start ---------
 143   $wgEnableProfileInfo = true;
 144   $wgDBserver = "localhost"; // replace with DB server hostname
 145   // --------- End ---------
 146
 147 Usage:
 148   Run with "php fuzz-tester.php".
 149   To see the various command-line options, run "php fuzz-tester.php --help".
 150   To stop the script, press Ctrl-C.
 151
 152 Console output:
 153   - If requested, first any previously failed tests will be rerun.
 154   - Then new tests will be generated and run. Any tests that fail will be saved,
 155         and a brief message about why they failed will be printed on the console.
 156   - The console will show the number of tests run, time run, number of tests
 157         failed, number of tests being done per minute, and the name of the current test.
 158
 159 TODO:
 160   Some known things that could improve this script:
 161   - Logging in with cookie jar storage needed for some tests (as there are some
 162         pages that cannot be tested without being logged in, and which are currently
 163         untested - e.g. Special:Emailuser, Special:Preferences, adding to Watchist).
 164   - Testing of Timeline extension (I cannot test as ploticus has/had issues on
 165         my architecture).
 166
 167 */
 168
 169 // ///////////////////////// COMMAND LINE HELP ////////////////////////////////////
 170
 171 // This is a command line script, load MediaWiki env (gives command line options);
 172 require_once( dirname( __FILE__ ) . '/commandLine.inc' );
 173
 174 // if the user asked for an explanation of command line options.
 175 if ( isset( $options["help"] ) ) {
 176         print <<<ENDS
 177 MediaWiki $wgVersion fuzz tester
 178 Usage: php {$_SERVER["SCRIPT_NAME"]} [--quiet] [--base-url=<url-to-test-wiki>]
 179                                                    [--directory=<failed-test-path>] [--include-binary]
 180                                                    [--w3c-validate] [--delete-passed-retests] [--help]
 181                                                    [--user=<username>] [--password=<password>]
 182                                                    [--rerun-failed-tests] [--max-errors=<int>]
 183                                                    [--max-runtime=<num-minutes>]
 184                                                    [--specific-test=<test-name>]
 185
 186 Options:
 187   --quiet                 : Hides passed tests, shows only failed tests.
 188   --base-url              : URL to a wiki on which to run the tests.
 189                                                         The "http://" is optional and can be omitted.
 190   --directory             : Full path to directory for storing failed tests.
 191                                                         Will be created if it does not exist.
 192   --include-binary        : Includes non-alphanumeric characters in the tests.
 193   --w3c-validate          : Validates pages using the W3C's web validator.
 194                                                         Slow. Currently many pages fail validation.
 195   --user                  : Login name of a valid user on your test wiki.
 196   --password              : Password for the valid user on your test wiki.
 197   --delete-passed-retests : Will delete retests that now pass.
 198                                                         Requires --rerun-failed-tests to be meaningful.
 199   --rerun-failed-tests    : Whether to rerun any previously failed tests.
 200   --max-errors            : Maximum number of errors to report before exiting.
 201                                                         Does not include errors from --rerun-failed-tests
 202   --max-runtime           : Maximum runtime, in minutes, to run before exiting.
 203                                                         Only applies to new tests, not --rerun-failed-tests
 204   --specific-test         : Runs only the specified fuzz test.
 205                                                         Only applies to new tests, not --rerun-failed-tests
 206   --keep-passed-tests     : Saves all test files, even those that pass.
 207   --help                  : Show this help message.
 208
 209 Example:
 210   If you wanted to fuzz test a nightly MediaWiki checkout using cron for 1 hour,
 211   and only wanted to be informed of errors, and did not want to redo previously
 212   failed tests, and wanted a maximum of 100 errors, then you could do:
 213   php {$_SERVER["SCRIPT_NAME"]} --quiet --max-errors=100 --max-runtime=60
 214
 215
 216 ENDS;
 217
 218         exit( 0 );
 219 }
 220
 221
 222 // if we got command line options, check they look valid.
 223 $validOptions = array ( "quiet", "base-url", "directory", "include-binary",
 224                 "w3c-validate", "user", "password", "delete-passed-retests",
 225                 "rerun-failed-tests", "max-errors",
 226                 "max-runtime", "specific-test", "keep-passed-tests", "help" );
 227 if ( !empty( $options ) ) {
 228         $unknownArgs = array_diff ( array_keys( $options ), $validOptions );
 229         foreach ( $unknownArgs as $invalidArg ) {
 230                 print "Ignoring invalid command-line option: --$invalidArg\n";
 231         }
 232 }
 233
 234
 235 // /////////////////////////// CONFIGURATION ////////////////////////////////////
 236
 237 // URL to some wiki on which we can run our tests.
 238 if ( !empty( $options["base-url"] ) ) {
 239         define( "WIKI_BASE_URL", $options["base-url"] );
 240 } else {
 241         define( "WIKI_BASE_URL", $wgServer . $wgScriptPath . '/' );
 242 }
 243
 244 // The directory name where we store the output.
 245 // Example for Windows: "c:\\temp\\wiki-fuzz"
 246 if ( !empty( $options["directory"] ) ) {
 247         define( "DIRECTORY", $options["directory"] );
 248 } else {
 249         define( "DIRECTORY", "{$wgUploadDirectory}/fuzz-tests" );
 250 }
 251
 252 // Should our test fuzz data include binary strings?
 253 define( "INCLUDE_BINARY",  isset( $options["include-binary"] ) );
 254
 255 // Whether we want to validate HTML output on the web.
 256 // At the moment very few generated pages will validate, so not recommended.
 257 define( "VALIDATE_ON_WEB", isset( $options["w3c-validate"] ) );
 258 // URL to use to validate our output:
 259 define( "VALIDATOR_URL",  "http://validator.w3.org/check" );
 260
 261 // Location of Tidy standalone executable.
 262 define( "PATH_TO_TIDY",  "/usr/bin/tidy" );
 263
 264 // The name of a user who has edited on your wiki. Used
 265 // when testing the Special:Contributions and Special:Userlogin page.
 266 if ( !empty( $options["user"] ) ) {
 267         define( "USER_ON_WIKI", $options["user"] );
 268 } else {
 269         define( "USER_ON_WIKI", "nickj" );
 270 }
 271
 272 // The password of the above user. Used when testing the login page,
 273 // and to do this we sometimes need to login successfully.
 274 if ( !empty( $options["password"] ) ) {
 275         define( "USER_PASSWORD", $options["password"] );
 276 } else {
 277         // And no, this is not a valid password on any public wiki.
 278         define( "USER_PASSWORD", "nickj" );
 279 }
 280
 281 // If we have a test that failed, and then we run it again, and it passes,
 282 // do you want to delete it or keep it?
 283 define( "DELETE_PASSED_RETESTS", isset( $options["delete-passed-retests"] ) );
 284
 285 // Do we want to rerun old saved tests at script startup?
 286 // Set to true to help catch regressions, or false if you only want new stuff.
 287 define( "RERUN_OLD_TESTS", isset( $options["rerun-failed-tests"] ) );
 288
 289 // File where the database errors are logged. Should be defined in LocalSettings.php.
 290 define( "DB_ERROR_LOG_FILE", $wgDBerrorLog );
 291
 292 // Run in chatty mode (all output, default), or run in quiet mode (only prints out details of failed tests)?
 293 define( "QUIET", isset( $options["quiet"] ) );
 294
 295 // Keep all test files, even those that pass. Potentially useful to tracking input that causes something
 296 // unusual to happen, if you don't know what "unusual" is until later.
 297 define( "KEEP_PASSED_TESTS", isset( $options["keep-passed-tests"] ) );
 298
 299 // The maximum runtime, if specified.
 300 if ( !empty( $options["max-runtime"] ) && intval( $options["max-runtime"] ) > 0 ) {
 301         define( "MAX_RUNTIME", intval( $options["max-runtime"] ) );
 302 }
 303
 304 // The maximum number of problems to find, if specified. Excludes retest errors.
 305 if ( !empty( $options["max-errors"] ) && intval( $options["max-errors"] ) > 0 ) {
 306         define( "MAX_ERRORS", intval( $options["max-errors"] ) );
 307 }
 308
 309 // if the user has requested a specific test (instead of all tests), and the test they asked for looks valid.
 310 if ( !empty( $options["specific-test"] ) ) {
 311         if ( class_exists( $options["specific-test"] ) && get_parent_class( $options["specific-test"] ) == "pageTest" ) {
 312                 define( "SPECIFIC_TEST", $options["specific-test"] );
 313         }
 314         else {
 315                 print "Ignoring invalid --specific-test\n";
 316         }
 317 }
 318
 319 // Define the file extensions we'll use:
 320 define( "PHP_TEST" , ".test.php" );
 321 define( "CURL_TEST", ".curl.sh" );
 322 define( "DATA_FILE", ".data.bin" );
 323 define( "INFO_FILE", ".info.txt" );
 324 define( "HTML_FILE", ".wiki_preview.html" );
 325
 326 // If it goes wrong, we want to know about it.
 327 error_reporting( E_ALL | E_STRICT );
 328
 329 // //////////////  A CLASS THAT GENERATES RANDOM NASTY WIKI & HTML STRINGS  //////////////////////
 330
 331 class wikiFuzz {
 332
 333         // Only some HTML tags are understood with params by MediaWiki, the rest are ignored.
 334         // List the tags that accept params below, as well as what those params are.
 335         public static $data = array(
 336                         "B"          => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 337                         "CAPTION"    => array( "CLASS", "ID", "STYLE", "align", "lang", "dir", "title" ),
 338                         "CENTER"     => array( "CLASS", "STYLE", "ID", "lang", "dir", "title" ),
 339                         "DIV"        => array( "CLASS", "STYLE", "ID", "align", "lang", "dir", "title" ),
 340                         "FONT"       => array( "CLASS", "STYLE", "ID", "lang", "dir", "title", "face", "size", "color" ),
 341                         "H1"         => array( "STYLE", "CLASS", "ID", "align", "lang", "dir", "title" ),
 342                         "H2"         => array( "STYLE", "CLASS", "ID", "align", "lang", "dir", "title" ),
 343                         "HR"         => array( "STYLE", "CLASS", "ID", "WIDTH", "lang", "dir", "title", "size", "noshade" ),
 344                         "LI"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title", "type", "value" ),
 345                         "TABLE"      => array( "STYLE", "CLASS", "ID", "BGCOLOR", "WIDTH", "ALIGN", "BORDER", "CELLPADDING",
 346                                                                    "CELLSPACING", "lang", "dir", "title", "summary", "frame", "rules" ),
 347                         "TD"         => array( "STYLE", "CLASS", "ID", "BGCOLOR", "WIDTH", "ALIGN", "COLSPAN", "ROWSPAN",
 348                                                                   "VALIGN", "abbr", "axis", "headers", "scope", "nowrap", "height", "lang",
 349                                                                   "dir", "title", "char", "charoff" ),
 350                         "TH"         => array( "STYLE", "CLASS", "ID", "BGCOLOR", "WIDTH", "ALIGN", "COLSPAN", "ROWSPAN",
 351                                                                   "VALIGN", "abbr", "axis", "headers", "scope", "nowrap", "height", "lang",
 352                                                                   "dir", "title", "char", "charoff" ),
 353                         "TR"         => array( "CLASS", "STYLE", "ID", "BGCOLOR", "ALIGN", "VALIGN", "lang", "dir", "title", "char", "charoff" ),
 354                         "UL"         => array( "CLASS", "STYLE", "ID", "lang", "dir", "title", "type" ),
 355                         "P"          => array( "style", "class", "id", "align", "lang", "dir", "title" ),
 356                         "blockquote" => array( "CLASS", "ID", "STYLE", "lang", "dir", "title", "cite" ),
 357                         "span"       => array( "CLASS", "ID", "STYLE", "align", "lang", "dir", "title" ),
 358                         "code"       => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 359                         "tt"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 360                         "small"      => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 361                         "big"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 362                         "s"          => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 363                         "u"          => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 364                         "del"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title", "datetime", "cite" ),
 365                         "ins"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title", "datetime", "cite" ),
 366                         "sub"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 367                         "sup"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 368                         "ol"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title", "type", "start" ),
 369                         "br"         => array( "CLASS", "ID", "STYLE", "title", "clear" ),
 370                         "cite"       => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 371                         "var"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 372                         "dl"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 373                         "ruby"       => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 374                         "rt"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 375                         "rp"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 376                         "dt"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 377                         "dl"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 378                         "em"         => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 379                         "strong"     => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 380                         "i"          => array( "CLASS", "ID", "STYLE", "lang", "dir", "title" ),
 381                         "thead"      => array( "CLASS", "ID", "STYLE", "lang", "dir", "title",  'align', 'char', 'charoff', 'valign' ),
 382                         "tfoot"      => array( "CLASS", "ID", "STYLE", "lang", "dir", "title",  'align', 'char', 'charoff', 'valign' ),
 383                         "tbody"      => array( "CLASS", "ID", "STYLE", "lang", "dir", "title",  'align', 'char', 'charoff', 'valign' ),
 384                         "colgroup"   => array( "CLASS", "ID", "STYLE", "lang", "dir", "title",  'align', 'char', 'charoff', 'valign', 'span', 'width' ),
 385                         "col"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title",  'align', 'char', 'charoff', 'valign', 'span', 'width' ),
 386                         "pre"        => array( "CLASS", "ID", "STYLE", "lang", "dir", "title", "width" ),
 387
 388                         // extension tags that accept parameters:
 389                         "sort"         => array( "order", "class" ),
 390                         "ref"          => array( "name" ),
 391                         "categorytree" => array( "hideroot", "mode", "style" ),
 392                         "chemform"     => array( "link", "wikilink", "query" ),
 393                         "section"      => array( "begin", "new" ),
 394
 395                         // older MW transclusion.
 396                         "transclude"   => array( "page" ),
 397                                 );
 398
 399         // The types of the HTML that we will be testing were defined above
 400         // Note: this needs to be initialized later to be equal to: array_keys(wikiFuzz::$data);
 401         // as such, it also needs to also be publicly modifiable.
 402         public static $types;
 403
 404
 405         // Some attribute values.
 406         static private $other = array( "&", "=", ":", "?", "\"", "\n", "%n%n%n%n%n%n%n%n%n%n%n%n", "\\" );
 407         static private $ints  = array(
 408                         // various numbers
 409                         "0", "-1", "127", "-7897", "89000", "808080", "90928345",
 410                         "0xfffffff", "ffff",
 411
 412                         // Different ways of saying: '
 413                         "&#0000039;", // Long UTF-8 Unicode encoding
 414                         "&#39;",  // dec version.
 415                         "&#x27;", // hex version.
 416                         "&#xA7;", // malformed hex variant, MSB not zero.
 417
 418                         // Different ways of saying: "
 419                         "&#0000034;", // Long UTF-8 Unicode encoding
 420                         "&#34;",
 421                         "&#x22;", // hex version.
 422                         "&#xA2;", // malformed hex variant, MSB not zero.
 423
 424                         // Different ways of saying: <
 425                         "<",
 426                         "&#0000060",  // Long UTF-8 Unicode encoding without semicolon (Mediawiki wants the colon)
 427                         "&#0000060;", // Long UTF-8 Unicode encoding with semicolon
 428                         "&#60;",
 429                         "&#x3C;",     // hex version.
 430                         "&#xBC;",     // malformed hex variant, MSB not zero.
 431                         "&#x0003C;",  // mid-length hex version
 432                         "&#X00003C;", // slightly longer hex version, with capital "X"
 433
 434                         // Different ways of saying: >
 435                         ">",
 436                         "&#0000062;", // Long UTF-8 Unicode encoding
 437                         "&#62;",
 438                         "&#x3E;",     // hex version.
 439                         "&#xBE;",     // malformed variant, MSB not zero.
 440
 441                         // Different ways of saying: [
 442                         "&#0000091;", // Long UTF-8 Unicode encoding
 443                         "&#91;",
 444                         "&#x5B;",     // hex version.
 445
 446                         // Different ways of saying: {{
 447                         "&#0000123;&#0000123;", // Long UTF-8 Unicode encoding
 448                         "&#123;&#123;",
 449                         "&#x7B;&#x7B;",         // hex version.
 450
 451                         // Different ways of saying: |
 452                         "&#0000124;", // Long UTF-8 Unicode encoding
 453                         "&#124;",
 454                         "&#x7C;",     // hex version.
 455                         "&#xFC;",     // malformed hex variant, MSB not zero.
 456
 457                         // a "lignature" - http://www.robinlionheart.com/stds/html4/spchars#ligature
 458                         // &#8204; == &zwnj;
 459                         "&#8204;"
 460                                 );
 461
 462         // Defines various wiki-related bits of syntax, that can potentially cause
 463         // MediaWiki to do something other than just print that literal text.
 464         static private $ext = array(
 465                         // links, templates, parameters.
 466                         "[[", "]]", "{{", "}}", "|", "[", "]", "{{{", "}}}", "|]]",
 467
 468                         // wiki tables.
 469                         "\n{|", "\n|}",
 470                         "!",
 471                         "\n!",
 472                         "!!",
 473                         "||",
 474                         "\n|-", "| ", "\n|",
 475
 476                         // section headings.
 477                         "=", "==", "===", "====", "=====", "======",
 478
 479                         // lists (ordered and unordered) and indentation.
 480                         "\n*", "*", "\n:", ":",
 481                         "\n#", "#",
 482
 483                         // definition lists (dl, dt, dd), newline, and newline with pre, and a tab.
 484                         "\n;", ";", "\n ",
 485
 486                         // Whitespace: newline, tab, space.
 487                         "\n", "\t", " ",
 488
 489                         // Some XSS attack vectors from http://ha.ckers.org/xss.html
 490                         "&#x09;", // tab
 491                         "&#x0A;", // newline
 492                         "&#x0D;", // carriage return
 493                         "\0",     // null character
 494                         " &#14; ", // spaces and meta characters
 495                         "'';!--\"<XSS>=&{()}", // compact injection of XSS & SQL tester
 496
 497                         // various NULL fields
 498                         "%00",
 499                         "&#00;",
 500                         "\0",
 501
 502                         // horizontal rule.
 503                         "-----", "\n-----",
 504
 505                         // signature, redirect, bold, italics.
 506                         "~~~~", "#REDIRECT [[", "'''", "''",
 507
 508                         // comments.
 509                         "<!--", "-->",
 510
 511                         // quotes.
 512                         "\"", "'",
 513
 514                         // tag start and tag end.
 515                         "<", ">",
 516
 517                         // implicit link creation on URIs.
 518                         "http://",
 519                         "https://",
 520                         "ftp://",
 521                         "irc://",
 522                         "news:",
 523                         'gopher://',
 524                         'telnet://',
 525                         'nntp://',
 526                         'worldwind://',
 527                         'mailto:',
 528
 529                         // images.
 530                         "[[image:",
 531                         ".gif",
 532                         ".png",
 533                         ".jpg",
 534                         ".jpeg",
 535                         'thumbnail=',
 536                         'thumbnail',
 537                         'thumb=',
 538                         'thumb',
 539                         'right',
 540                         'none',
 541                         'left',
 542                         'framed',
 543                         'frame',
 544                         'enframed',
 545                         'centre',
 546                         'center',
 547                         "Image:",
 548                         "[[:Image",
 549                         'px',
 550                         'upright=',
 551                         'border',
 552
 553                         // misc stuff to throw at the Parser.
 554                         '%08X',
 555                         '/',
 556                         ":x{|",
 557                         "\n|+",
 558                         "<noinclude>",
 559                         "</noinclude>",
 560                         " \302\273",
 561                         " :",
 562                         " !",
 563                         " ;",
 564                         "\302\253",
 565                         "[[category:",
 566                         "?=",
 567                         "(",
 568                         ")",
 569                         "]]]",
 570                         "../",
 571                         "{{{{",
 572                         "}}}}",
 573                         "[[Special:",
 574                         "<includeonly>",
 575                         "</includeonly>",
 576                         "<!--MWTEMPLATESECTION=",
 577                         '<!--MWTOC-->',
 578
 579                         // implicit link creation on booknum, RFC, and PubMed ID usage (both with and without IDs)
 580                         "ISBN 2",
 581                         "RFC 000",
 582                         "PMID 000",
 583                         "ISBN ",
 584                         "RFC ",
 585                         "PMID ",
 586
 587                         // magic words:
 588                         '__NOTOC__',
 589                         '__FORCETOC__',
 590                         '__NOEDITSECTION__',
 591                         '__START__',
 592                         '__NOTITLECONVERT__',
 593                         '__NOCONTENTCONVERT__',
 594                         '__END__',
 595                         '__TOC__',
 596                         '__NOTC__',
 597                         '__NOCC__',
 598                         "__FORCETOC__",
 599                         "__NEWSECTIONLINK__",
 600                         "__NOGALLERY__",
 601
 602                         // more magic words / internal templates.
 603                         '{{PAGENAME}}',
 604                         '{{PAGENAMEE}}',
 605                         '{{NAMESPACE}}',
 606                         "{{MSG:",
 607                         "}}",
 608                         "{{MSGNW:",
 609                         "}}",
 610                         "{{INT:",
 611                         "}}",
 612                         '{{SITENAME}}',
 613                         "{{NS:",
 614                         "}}",
 615                         "{{LOCALURL:",
 616                         "}}",
 617                         "{{LOCALURLE:",
 618                         "}}",
 619                         "{{SCRIPTPATH}}",
 620                         "{{GRAMMAR:gentiv|",
 621                         "}}",
 622                         "{{REVISIONID}}",
 623                         "{{SUBPAGENAME}}",
 624                         "{{SUBPAGENAMEE}}",
 625                         "{{ns:0}}",
 626                         "{{fullurle:",
 627                         "}}",
 628                         "{{subst::",
 629                         "}}",
 630                         "{{UCFIRST:",
 631                         "}}",
 632                         "{{UC:",
 633                         '{{SERVERNAME}}',
 634                         '{{SERVER}}',
 635                         "{{RAW:",
 636                         "}}",
 637                         "{{PLURAL:",
 638                         "}}",
 639                         "{{LCFIRST:",
 640                         "}}",
 641                         "{{LC:",
 642                         "}}",
 643                         '{{CURRENTWEEK}}',
 644                         '{{CURRENTDOW}}',
 645                         "{{INT:{{LC:contribs-showhideminor}}|",
 646                         "}}",
 647                         "{{INT:googlesearch|",
 648                         "}}",
 649                         "{{BASEPAGENAME}}",
 650                         "{{CONTENTLANGUAGE}}",
 651                         "{{PAGESINNAMESPACE:}}",
 652                         "{{#language:",
 653                         "}}",
 654                         "{{#special:",
 655                         "}}",
 656                         "{{#special:emailuser",
 657                         "}}",
 658
 659                         // Some raw link for magic words.
 660                         "{{NUMBEROFPAGES:R",
 661                         "}}",
 662                         "{{NUMBEROFUSERS:R",
 663                         "}}",
 664                         "{{NUMBEROFARTICLES:R",
 665                         "}}",
 666                         "{{NUMBEROFFILES:R",
 667                         "}}",
 668                         "{{NUMBEROFADMINS:R",
 669                         "}}",
 670                         "{{padleft:",
 671                         "}}",
 672                         "{{padright:",
 673                         "}}",
 674                         "{{DEFAULTSORT:",
 675                         "}}",
 676
 677                         // internal Math "extension":
 678                         "<math>",
 679                         "</math>",
 680
 681                         // Parser extension functions:
 682                         "{{#expr:",
 683                         "{{#if:",
 684                         "{{#ifeq:",
 685                         "{{#ifexist:",
 686                         "{{#ifexpr:",
 687                         "{{#switch:",
 688                         "{{#time:",
 689                         "}}",
 690
 691                         // references table for the Cite extension.
 692                         "<references/>",
 693
 694                         // Internal Parser tokens - try inserting some of these.
 695                         "UNIQ25f46b0524f13e67NOPARSE",
 696                         "UNIQ17197916557e7cd6-HTMLCommentStrip46238afc3bb0cf5f00000002",
 697                         "\x07UNIQ17197916557e7cd6-HTMLCommentStrip46238afc3bb0cf5f00000002-QINU",
 698
 699                         // Inputbox extension:
 700                         "<inputbox>\ntype=search\nsearchbuttonlabel=\n",
 701                         "</inputbox>",
 702
 703                         // charInsert extension:
 704                         "<charInsert>",
 705                         "</charInsert>",
 706
 707                         // wikiHiero extension:
 708                         "<hiero>",
 709                         "</hiero>",
 710
 711                         // Image gallery:
 712                         "<gallery>",
 713                         "</gallery>",
 714
 715                         // FixedImage extension.
 716                         "<fundraising/>",
 717
 718                         // Timeline extension: currently untested.
 719
 720                         // Nowiki:
 721                         "<nOwIkI>",
 722                         "</nowiki>",
 723
 724                         // an external image to test the external image displaying code
 725                         "http://debian.org/Pics/debian.png",
 726
 727                         // LabeledSectionTransclusion extension.
 728                         "{{#lstx:",
 729                         "}}",
 730                         "{{#lst:",
 731                         "}}",
 732                         "{{#lst:Main Page|",
 733                         "}}"
 734                         );
 735
 736         /**
 737          ** Randomly returns one element of the input array.
 738          */
 739         static public function chooseInput( array $input ) {
 740                 $randindex = wikiFuzz::randnum( count( $input ) - 1 );
 741                 return $input[$randindex];
 742         }
 743
 744         // Max number of parameters for HTML attributes.
 745         static private $maxparams = 10;
 746
 747         /**
 748          ** Returns random number between finish and start.
 749          */
 750         static public function randnum( $finish, $start = 0 ) {
 751                 return mt_rand( $start, $finish );
 752         }
 753
 754         /**
 755          ** Returns a mix of random text and random wiki syntax.
 756          */
 757         static private function randstring() {
 758                 $thestring = "";
 759
 760                 for ( $i = 0; $i < 40; $i++ ) {
 761                         $what = wikiFuzz::randnum( 1 );
 762
 763                         if ( $what == 0 ) { // include some random wiki syntax
 764                                 $which = wikiFuzz::randnum( count( wikiFuzz::$ext ) - 1 );
 765                                 $thestring .= wikiFuzz::$ext[$which];
 766                         }
 767                         else { // include some random text
 768                                 $char = INCLUDE_BINARY
 769                                         // Decimal version:
 770                                         // "&#" . wikiFuzz::randnum(255) . ";"
 771                                         // Hex version:
 772                                         ? "&#x" . str_pad( dechex( wikiFuzz::randnum( 255 ) ), wikiFuzz::randnum( 2, 7 ), "0", STR_PAD_LEFT ) . ";"
 773                                         // A truly binary version:
 774                                         // ? chr(wikiFuzz::randnum(0,255))
 775                                         : chr( wikiFuzz::randnum( 126, 32 ) );
 776
 777                                 $length = wikiFuzz::randnum( 8 );
 778                                 $thestring .= str_repeat ( $char, $length );
 779                         }
 780                 }
 781                 return $thestring;
 782         }
 783
 784         /**
 785          ** Returns either random text, or random wiki syntax, or random data from "ints",
 786          **        or random data from "other".
 787          */
 788         static private function makestring() {
 789                 $what = wikiFuzz::randnum( 2 );
 790                 if ( $what == 0 ) {
 791                         return wikiFuzz::randstring();
 792                 }
 793                 elseif ( $what == 1 ) {
 794                         return wikiFuzz::$ints[wikiFuzz::randnum( count( wikiFuzz::$ints ) - 1 )];
 795                 }
 796                 else {
 797                         return wikiFuzz::$other[wikiFuzz::randnum( count( wikiFuzz::$other ) - 1 )];
 798                 }
 799         }
 800
 801
 802         /**
 803          ** Strips out the stuff that Mediawiki balks at in a page's title.
 804          **        Implementation copied/pasted from cleanupTable.inc & cleanupImages.php
 805          */
 806         static public function makeTitleSafe( $str ) {
 807                 $legalTitleChars = " %!\"$&'()*,\\-.\\/0-9:;=?@A-Z\\\\^_`a-z~\\x80-\\xFF";
 808                 return preg_replace_callback(
 809                                 "/([^$legalTitleChars])/",
 810                                 create_function(
 811                                         // single quotes are essential here,
 812                                         // or alternative escape all $ as \$
 813                                         '$matches',
 814                                         'return sprintf( "\\x%02x", ord( $matches[1] ) );'
 815                                         ),
 816                                 $str );
 817         }
 818
 819         /**
 820          ** Returns a string of fuzz text.
 821          */
 822         static private function loop() {
 823                 switch ( wikiFuzz::randnum( 3 ) ) {
 824                         case 1: // an opening tag, with parameters.
 825                                 $string = "";
 826                                 $i = wikiFuzz::randnum( count( wikiFuzz::$types ) - 1 );
 827                                 $t = wikiFuzz::$types[$i];
 828                                 $arr = wikiFuzz::$data[$t];
 829                                 $string .= "<" . $t . " ";
 830                                 $num_params = min( wikiFuzz::$maxparams, count( $arr ) );
 831                                 for ( $z = 0; $z < $num_params; $z++ ) {
 832                                         $badparam = $arr[wikiFuzz::randnum( count( $arr ) - 1 )];
 833                                         $badstring = wikiFuzz::makestring();
 834                                         $string .= $badparam . "=" . wikiFuzz::getRandQuote() . $badstring . wikiFuzz::getRandQuote() . " ";
 835                                 }
 836                                 $string .= ">\n";
 837                                 return $string;
 838                         case 2: // a closing tag.
 839                                 $i = wikiFuzz::randnum( count( wikiFuzz::$types ) - 1 );
 840                                 return "</" . wikiFuzz::$types[$i] . ">";
 841                         case 3: // a random string, between tags.
 842                                 return wikiFuzz::makeString();
 843                 }
 844                 return "";    // catch-all, should never be called.
 845         }
 846
 847         /**
 848          ** Returns one of the three styles of random quote: ', ", and nothing.
 849          */
 850         static private function getRandQuote() {
 851                 switch ( wikiFuzz::randnum( 3 ) ) {
 852                         case 1 : return "'";
 853                         case 2 : return "\"";
 854                         default: return "";
 855                 }
 856         }
 857
 858         /**
 859          ** Returns fuzz text, with the parameter indicating approximately how many lines of text you want.
 860          */
 861         static public function makeFuzz( $maxtypes = 2 ) {
 862                 $page = "";
 863                 for ( $k = 0; $k < $maxtypes; $k++ ) {
 864                         $page .= wikiFuzz::loop();
 865                 }
 866                 return $page;
 867         }
 868 }
 869
 870
 871 // //////   MEDIAWIKI PAGES TO TEST, AND HOW TO TEST THEM  ///////
 872
 873 /**
 874  ** A page test has just these things:
 875  **        1) Form parameters.
 876  **        2) the URL we are going to test those parameters on.
 877  **        3) Any cookies required for the test.
 878  **        4) Whether Tidy should validate the page. Defaults to true, but can be turned off.
 879  **        Declared abstract because it should be extended by a class
 880  **        that supplies these parameters.
 881  */
 882 abstract class pageTest {
 883         protected $params;
 884         protected $pagePath;
 885         protected $cookie = "";
 886         protected $tidyValidate = true;
 887
 888         public function getParams() {
 889                 return $this->params;
 890         }
 891
 892         public function getPagePath() {
 893                 return $this->pagePath;
 894         }
 895
 896         public function getCookie() {
 897                 return $this->cookie;
 898         }
 899
 900         public function tidyValidate() {
 901                 return $this->tidyValidate;
 902         }
 903 }
 904
 905
 906 /**
 907  ** a page test for the "Edit" page. Tests Parser.php and Sanitizer.php.
 908  */
 909 class editPageTest extends pageTest {
 910         function __construct() {
 911                 $this->pagePath = "index.php?title=WIKIFUZZ";
 912
 913                 $this->params = array (
 914                                 "action"        => "submit",
 915                                 "wpMinoredit"   => wikiFuzz::makeFuzz( 2 ),
 916                                 "wpPreview"     => wikiFuzz::makeFuzz( 2 ),
 917                                 "wpSection"     => wikiFuzz::makeFuzz( 2 ),
 918                                 "wpEdittime"    => wikiFuzz::makeFuzz( 2 ),
 919                                 "wpSummary"     => wikiFuzz::makeFuzz( 2 ),
 920                                 "wpScrolltop"   => wikiFuzz::makeFuzz( 2 ),
 921                                 "wpStarttime"   => wikiFuzz::makeFuzz( 2 ),
 922                                 "wpAutoSummary" => wikiFuzz::makeFuzz( 2 ),
 923                                 "wpTextbox1"    => wikiFuzz::makeFuzz( 40 )  // the main wiki text, need lots of this.
 924                                 );
 925
 926                 // sometimes we don't want to specify certain parameters.
 927                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpSection"] );
 928                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpEdittime"] );
 929                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpSummary"] );
 930                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpScrolltop"] );
 931                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpStarttime"] );
 932                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpAutoSummary"] );
 933                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpTextbox1"] );
 934         }
 935 }
 936
 937
 938 /**
 939  ** a page test for "Special:Listusers".
 940  */
 941 class listusersTest extends pageTest {
 942         function __construct() {
 943                 $this->pagePath = "index.php?title=Special:Listusers";
 944
 945                 $this->params = array (
 946                                 "title"        => wikiFuzz::makeFuzz( 2 ),
 947                                 "group"        => wikiFuzz::makeFuzz( 2 ),
 948                                 "username"     => wikiFuzz::makeFuzz( 2 ),
 949                                 "Go"           => wikiFuzz::makeFuzz( 2 ),
 950                                 "limit"        => wikiFuzz::chooseInput( array( "0", "-1", "---'----------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
 951                                 "offset"       => wikiFuzz::chooseInput( array( "0", "-1", "--------'-----0", "+1", "81343242346234234", wikiFuzz::makeFuzz( 2 ) ) )
 952                                 );
 953         }
 954 }
 955
 956
 957 /**
 958  ** a page test for "Special:Search".
 959  */
 960 class searchTest extends pageTest {
 961         function __construct() {
 962                 $this->pagePath = "index.php?title=Special:Search";
 963
 964                 $this->params = array (
 965                                 "action"        => "index.php?title=Special:Search",
 966                                 "ns0"           => wikiFuzz::makeFuzz( 2 ),
 967                                 "ns1"           => wikiFuzz::makeFuzz( 2 ),
 968                                 "ns2"           => wikiFuzz::makeFuzz( 2 ),
 969                                 "ns3"           => wikiFuzz::makeFuzz( 2 ),
 970                                 "ns4"           => wikiFuzz::makeFuzz( 2 ),
 971                                 "ns5"           => wikiFuzz::makeFuzz( 2 ),
 972                                 "ns6"           => wikiFuzz::makeFuzz( 2 ),
 973                                 "ns7"           => wikiFuzz::makeFuzz( 2 ),
 974                                 "ns8"           => wikiFuzz::makeFuzz( 2 ),
 975                                 "ns9"           => wikiFuzz::makeFuzz( 2 ),
 976                                 "ns10"          => wikiFuzz::makeFuzz( 2 ),
 977                                 "ns11"          => wikiFuzz::makeFuzz( 2 ),
 978                                 "ns12"          => wikiFuzz::makeFuzz( 2 ),
 979                                 "ns13"          => wikiFuzz::makeFuzz( 2 ),
 980                                 "ns14"          => wikiFuzz::makeFuzz( 2 ),
 981                                 "ns15"          => wikiFuzz::makeFuzz( 2 ),
 982                                 "redirs"        => wikiFuzz::makeFuzz( 2 ),
 983                                 "search"        => wikiFuzz::makeFuzz( 2 ),
 984                                 "offset"        => wikiFuzz::chooseInput( array( "", "0", "-1", "--------'-----0", "+1", "81343242346234234", wikiFuzz::makeFuzz( 2 ) ) ),
 985                                 "fulltext"      => wikiFuzz::chooseInput( array( "", "0", "1", "--------'-----0", "+1", wikiFuzz::makeFuzz( 2 ) ) ),
 986                                 "searchx"       => wikiFuzz::chooseInput( array( "", "0", "1", "--------'-----0", "+1", wikiFuzz::makeFuzz( 2 ) ) )
 987                                         );
 988         }
 989 }
 990
 991
 992 /**
 993  ** a page test for "Special:Recentchanges".
 994  */
 995 class recentchangesTest extends pageTest {
 996         function __construct() {
 997                 $this->pagePath = "index.php?title=Special:Recentchanges";
 998
 999                 $this->params = array (
1000                                 "action"        => wikiFuzz::makeFuzz( 2 ),
1001                                 "title"         => wikiFuzz::makeFuzz( 2 ),
1002                                 "namespace"     => wikiFuzz::chooseInput( range( -1, 15 ) ),
1003                                 "Go"            => wikiFuzz::makeFuzz( 2 ),
1004                                 "invert"        => wikiFuzz::chooseInput( array( "-1", "---'----------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1005                                 "hideanons"     => wikiFuzz::chooseInput( array( "-1", "------'-------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1006                                 'limit'         => wikiFuzz::chooseInput( array( "0", "-1", "---------'----0", "+1", "81340909772349234",  wikiFuzz::makeFuzz( 2 ) ) ),
1007                                 "days"          => wikiFuzz::chooseInput( array( "-1", "----------'---0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1008                                 "hideminor"     => wikiFuzz::chooseInput( array( "-1", "-----------'--0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1009                                 "hidebots"      => wikiFuzz::chooseInput( array( "-1", "---------'----0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1010                                 "hideliu"       => wikiFuzz::chooseInput( array( "-1", "-------'------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1011                                 "hidepatrolled" => wikiFuzz::chooseInput( array( "-1", "-----'--------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1012                                 "hidemyself"    => wikiFuzz::chooseInput( array( "-1", "--'-----------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1013                                 'categories_any' => wikiFuzz::chooseInput( array( "-1", "--'-----------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1014                                 'categories'    => wikiFuzz::chooseInput( array( "-1", "--'-----------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1015                                 'feed'          => wikiFuzz::chooseInput( array( "-1", "--'-----------0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) )
1016                                 );
1017         }
1018 }
1019
1020
1021 /**
1022  ** a page test for "Special:Prefixindex".
1023  */
1024 class prefixindexTest extends pageTest {
1025         function __construct() {
1026                 $this->pagePath = "index.php?title=Special:Prefixindex";
1027
1028                 $this->params = array (
1029                                 "title"         => "Special:Prefixindex",
1030                                 "namespace"     => wikiFuzz::randnum( -10, 101 ),
1031                                 "Go"            => wikiFuzz::makeFuzz( 2 )
1032                                 );
1033
1034                 // sometimes we want 'prefix', sometimes we want 'from', and sometimes we want nothing.
1035                 if ( wikiFuzz::randnum( 3 ) == 0 ) {
1036                         $this->params["prefix"] = wikiFuzz::chooseInput( array( "-1", "-----'--------0", "+++--+1",
1037                                                                                                  wikiFuzz::randnum( -10, 8134 ), wikiFuzz::makeFuzz( 2 ) ) );
1038                 }
1039                 if ( wikiFuzz::randnum( 3 ) == 0 ) {
1040                         $this->params["from"]   = wikiFuzz::chooseInput( array( "-1", "-----'--------0", "+++--+1",
1041                                                                                                 wikiFuzz::randnum( -10, 8134 ), wikiFuzz::makeFuzz( 2 ) ) );
1042                 }
1043         }
1044 }
1045
1046
1047 /**
1048  ** a page test for "Special:MIMEsearch".
1049  */
1050 class mimeSearchTest extends pageTest {
1051         function __construct() {
1052                 $this->pagePath = "index.php?title=Special:MIMEsearch";
1053
1054                 $this->params = array (
1055                                 "action"        => "index.php?title=Special:MIMEsearch",
1056                                 "mime"          => wikiFuzz::makeFuzz( 3 ),
1057                                 'limit'         => wikiFuzz::chooseInput( array( "0", "-1", "-------'------0", "+1", "81342321351235325",  wikiFuzz::makeFuzz( 2 ) ) ),
1058                                 'offset'        => wikiFuzz::chooseInput( array( "0", "-1", "-----'--------0", "+1", "81341231235365252234324",  wikiFuzz::makeFuzz( 2 ) ) )
1059                                 );
1060         }
1061 }
1062
1063
1064 /**
1065  ** a page test for "Special:Log".
1066  */
1067 class specialLogTest extends pageTest {
1068         function __construct() {
1069                 $this->pagePath = "index.php?title=Special:Log";
1070
1071                 $this->params = array (
1072                                 "type"        => wikiFuzz::chooseInput( array( "", wikiFuzz::makeFuzz( 2 ) ) ),
1073                                 "par"         => wikiFuzz::makeFuzz( 2 ),
1074                                 "user"        => wikiFuzz::makeFuzz( 2 ),
1075                                 "page"        => wikiFuzz::makeFuzz( 2 ),
1076                                 "from"        => wikiFuzz::makeFuzz( 2 ),
1077                                 "until"       => wikiFuzz::makeFuzz( 2 ),
1078                                 "title"       => wikiFuzz::makeFuzz( 2 )
1079                                 );
1080         }
1081 }
1082
1083
1084 /**
1085  ** a page test for "Special:Userlogin", with a successful login.
1086  */
1087 class successfulUserLoginTest extends pageTest {
1088         function __construct() {
1089                 $this->pagePath = "index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto=" . wikiFuzz::makeFuzz( 2 );
1090
1091                 $this->params = array (
1092                                 "wpName"          => USER_ON_WIKI,
1093                                 // sometimes real password, sometimes not:
1094                                 'wpPassword'      => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ), USER_PASSWORD ) ),
1095                                 'wpRemember'      => wikiFuzz::makeFuzz( 2 )
1096                                 );
1097
1098                 $this->cookie = "wikidb_session=" .  wikiFuzz::chooseInput( array( "1" , wikiFuzz::makeFuzz( 2 ) ) );
1099         }
1100 }
1101
1102
1103 /**
1104  ** a page test for "Special:Userlogin".
1105  */
1106 class userLoginTest extends pageTest {
1107         function __construct() {
1108
1109                 $this->pagePath = "index.php?title=Special:Userlogin";
1110
1111                 $this->params = array (
1112                                 'wpRetype'        => wikiFuzz::makeFuzz( 2 ),
1113                                 'wpRemember'      => wikiFuzz::makeFuzz( 2 ),
1114                                 'wpRealName'      => wikiFuzz::makeFuzz( 2 ),
1115                                 'wpPassword'      => wikiFuzz::makeFuzz( 2 ),
1116                                 'wpName'          => wikiFuzz::makeFuzz( 2 ),
1117                                 'wpMailmypassword' => wikiFuzz::makeFuzz( 2 ),
1118                                 'wpLoginattempt'  => wikiFuzz::makeFuzz( 2 ),
1119                                 'wpEmail'         => wikiFuzz::makeFuzz( 2 ),
1120                                 'wpDomain'        => wikiFuzz::chooseInput( array( "", "local", wikiFuzz::makeFuzz( 2 ) ) ),
1121                                 'wpCreateaccountMail' => wikiFuzz::chooseInput( array( "", wikiFuzz::makeFuzz( 2 ) ) ),
1122                                 'wpCreateaccount' => wikiFuzz::chooseInput( array( "", wikiFuzz::makeFuzz( 2 ) ) ),
1123                                 'wpCookieCheck'   => wikiFuzz::chooseInput( array( "", wikiFuzz::makeFuzz( 2 ) ) ),
1124                                 'type'            => wikiFuzz::chooseInput( array( "signup", "login", "", wikiFuzz::makeFuzz( 2 ) ) ),
1125                                 'returnto'        => wikiFuzz::makeFuzz( 2 ),
1126                                 'action'          => wikiFuzz::chooseInput( array( "", "submitlogin", wikiFuzz::makeFuzz( 2 ) ) )
1127                                 );
1128
1129                 $this->cookie = "wikidb_session=" . wikiFuzz::chooseInput( array( "1" , wikiFuzz::makeFuzz( 2 ) ) );
1130         }
1131 }
1132
1133
1134 /**
1135  ** a page test for "Special:Ipblocklist" (also includes unblocking)
1136  */
1137 class ipblocklistTest extends pageTest {
1138         function __construct() {
1139                 $this->pagePath = "index.php?title=Special:Ipblocklist";
1140
1141                 $this->params = array (
1142                                 'wpUnblockAddress' => wikiFuzz::makeFuzz( 2 ),
1143                                 'ip'              => wikiFuzz::chooseInput( array( "20398702394", "", "Nickj2", wikiFuzz::makeFuzz( 2 ),
1144                                                                          // something like an IP address, sometimes invalid:
1145                                                                          ( wikiFuzz::randnum( 300, -20 ) . "." . wikiFuzz::randnum( 300, -20 ) . "."
1146                                                                            . wikiFuzz::randnum( 300, -20 ) . "." . wikiFuzz::randnum( 300, -20 ) ) ) ),
1147                                 'id'              => wikiFuzz::makeFuzz( 2 ),
1148                                 'wpUnblockReason' => wikiFuzz::makeFuzz( 2 ),
1149                                 'action'          => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ), "success", "submit", "unblock" ) ),
1150                                 'wpEditToken'     => wikiFuzz::makeFuzz( 2 ),
1151                                 'wpBlock'         => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ), "" ) ),
1152                                 'limit'           => wikiFuzz::chooseInput( array( "0", "-1", "--------'-----0", "+1",
1153                                                                                                  "09700982312351132098234",  wikiFuzz::makeFuzz( 2 ) ) ),
1154                                 'offset'          => wikiFuzz::chooseInput( array( "0", "-1", "------'-------0", "+1",
1155                                                                                                  "09700980982341535324234234", wikiFuzz::makeFuzz( 2 ) ) )
1156                                 );
1157
1158                 // sometimes we don't want to specify certain parameters.
1159                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["action"] );
1160                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["ip"] );
1161                 if ( wikiFuzz::randnum( 2 ) == 0 ) unset( $this->params["id"] );
1162                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["wpUnblockAddress"] );
1163         }
1164 }
1165
1166
1167 /**
1168  ** a page test for "Special:Newimages".
1169  */
1170 class newImagesTest extends  pageTest {
1171         function __construct() {
1172                 $this->pagePath = "index.php?title=Special:Newimages";
1173
1174                 $this->params = array (
1175                                 'hidebots'  => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ), "1", "", "-1" ) ),
1176                                 'wpIlMatch' => wikiFuzz::makeFuzz( 2 ),
1177                                 'until'     => wikiFuzz::makeFuzz( 2 ),
1178                                 'from'      => wikiFuzz::makeFuzz( 2 )
1179                                 );
1180
1181                 // sometimes we don't want to specify certain parameters.
1182                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["until"] );
1183                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["from"] );
1184         }
1185 }
1186
1187
1188 /**
1189  ** a page test for the "Special:Imagelist" page.
1190  */
1191 class imagelistTest extends pageTest {
1192         function __construct() {
1193                 $this->pagePath = "index.php?title=Special:Imagelist";
1194
1195                 $this->params = array (
1196                                 'sort'      => wikiFuzz::chooseInput( array( "bysize", "byname" , "bydate", wikiFuzz::makeFuzz( 2 ) ) ),
1197                                 'limit'     => wikiFuzz::chooseInput( array( "0", "-1", "--------'-----0", "+1", "09700982312351132098234",  wikiFuzz::makeFuzz( 2 ) ) ),
1198                                 'offset'    => wikiFuzz::chooseInput( array( "0", "-1", "------'-------0", "+1", "09700980982341535324234234", wikiFuzz::makeFuzz( 2 ) ) ),
1199                                 'wpIlMatch' => wikiFuzz::makeFuzz( 2 )
1200                                 );
1201         }
1202 }
1203
1204
1205 /**
1206  ** a page test for "Special:Export".
1207  */
1208 class specialExportTest extends pageTest {
1209         function __construct() {
1210                 $this->pagePath = "index.php?title=Special:Export";
1211
1212                 $this->params = array (
1213                                 'action'      => wikiFuzz::chooseInput( array( "submit", "", wikiFuzz::makeFuzz( 2 ) ) ),
1214                                 'pages'       => wikiFuzz::makeFuzz( 2 ),
1215                                 'curonly'     => wikiFuzz::chooseInput( array( "", "0", "-1", wikiFuzz::makeFuzz( 2 ) ) ),
1216                                 'listauthors' => wikiFuzz::chooseInput( array( "", "0", "-1", wikiFuzz::makeFuzz( 2 ) ) ),
1217                                 'history'     => wikiFuzz::chooseInput( array( "0", "-1", "------'-------0", "+1", "09700980982341535324234234", wikiFuzz::makeFuzz( 2 ) ) ),
1218
1219                                 );
1220
1221                 // For the time being, need to disable "submit" action as Tidy barfs on MediaWiki's XML export.
1222                 if ( $this->params['action'] == 'submit' ) $this->params['action'] = '';
1223
1224                 // Sometimes remove the history field.
1225                 if ( wikiFuzz::randnum( 2 ) == 0 ) unset( $this->params["history"] );
1226
1227                 // page does not produce HTML.
1228                 $this->tidyValidate = false;
1229         }
1230 }
1231
1232
1233 /**
1234  ** a page test for "Special:Booksources".
1235  */
1236 class specialBooksourcesTest extends pageTest {
1237         function __construct() {
1238                 $this->pagePath = "index.php?title=Special:Booksources";
1239
1240                 $this->params = array (
1241                                 'go'    => wikiFuzz::makeFuzz( 2 ),
1242                                 // ISBN codes have to contain some semi-numeric stuff or will be ignored:
1243                                 'isbn'  => "0X0" . wikiFuzz::makeFuzz( 2 )
1244                                 );
1245         }
1246 }
1247
1248
1249 /**
1250  ** a page test for "Special:Allpages".
1251  */
1252 class specialAllpagesTest extends pageTest {
1253         function __construct() {
1254                 $this->pagePath = "index.php?title=Special%3AAllpages";
1255
1256                 $this->params = array (
1257                                 'from'      => wikiFuzz::makeFuzz( 2 ),
1258                                 'namespace' => wikiFuzz::chooseInput( range( -1, 15 ) ),
1259                                 'go'        => wikiFuzz::makeFuzz( 2 )
1260                                 );
1261         }
1262 }
1263
1264
1265 /**
1266  ** a page test for the page History.
1267  */
1268 class pageHistoryTest extends pageTest {
1269         function __construct() {
1270                 $this->pagePath = "index.php?title=Main_Page&action=history";
1271
1272                 $this->params = array (
1273                                 'limit'     => wikiFuzz::chooseInput( array( "-1", "0", "-------'------0", "+1", "8134",  wikiFuzz::makeFuzz( 2 ) ) ),
1274                                 'offset'    => wikiFuzz::chooseInput( array( "-1", "0", "------'-------0", "+1", "9823412312312412435", wikiFuzz::makeFuzz( 2 ) ) ),
1275                                 "go"        => wikiFuzz::chooseInput( array( "first", "last", wikiFuzz::makeFuzz( 2 ) ) ),
1276                                 "dir"       => wikiFuzz::chooseInput( array( "prev", "next", wikiFuzz::makeFuzz( 2 ) ) ),
1277                                 "diff"      => wikiFuzz::chooseInput( array( "-1", "--------'-----0", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1278                                 "oldid"     => wikiFuzz::chooseInput( array( "prev", "-1", "+1", "8134", wikiFuzz::makeFuzz( 2 ) ) ),
1279                                 "feed"      => wikiFuzz::makeFuzz( 2 )
1280                                 );
1281         }
1282 }
1283
1284
1285 /**
1286  ** a page test for the Special:Contributions".
1287  */
1288 class contributionsTest extends pageTest {
1289         function __construct() {
1290                 $this->pagePath = "index.php?title=Special:Contributions/" . USER_ON_WIKI;
1291
1292                 $this->params = array (
1293                                 'target'    => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ), "newbies", USER_ON_WIKI ) ),
1294                                 'namespace' => wikiFuzz::chooseInput( array( -1, 15, 1, wikiFuzz::makeFuzz( 2 ) ) ),
1295                                 'offset'    => wikiFuzz::chooseInput( array( "0", "-1", "------'-------0", "+1", "982342131232131231241", wikiFuzz::makeFuzz( 2 ) ) ),
1296                                 'bot'       => wikiFuzz::chooseInput( array( "", "-1", "0", "1", wikiFuzz::makeFuzz( 2 ) ) ),
1297                                 'go'        => wikiFuzz::chooseInput( array( "-1", 'prev', 'next', wikiFuzz::makeFuzz( 2 ) ) )
1298                                 );
1299         }
1300 }
1301
1302
1303 /**
1304  ** a page test for viewing a normal page, whilst posting various params.
1305  */
1306 class viewPageTest extends pageTest {
1307         function __construct() {
1308                 $this->pagePath = "index.php?title=Main_Page";
1309
1310                 $this->params = array (
1311                                 "useskin"        => wikiFuzz::chooseInput( array( "chick", "cologneblue", "myskin",
1312                                                                                 "nostalgia", "simple", "standard", wikiFuzz::makeFuzz( 2 ) ) ),
1313                                 "uselang"        => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ),
1314                                                 "ab", "af", "an", "ar", "arc", "as", "ast", "av", "ay", "az", "ba",
1315                                                 "bat-smg", "be", "bg", "bm", "bn", "bo", "bpy", "br", "bs", "ca",
1316                                                 "ce", "cs", "csb", "cv", "cy", "da", "de", "dv", "dz", "el", "en",
1317                                                 "eo", "es", "et", "eu", "fa", "fi", "fo", "fr", "fur", "fy", "ga",
1318                                                 "gn", "gsw", "gu", "he", "hi", "hr", "hu", "ia", "id", "ii", "is",
1319                                                 "it", "ja", "jv", "ka", "km", "kn", "ko", "ks", "ku", "kv", "la",
1320                                                 "li", "lo", "lt", "lv", "mk", "ml", "ms", "nah", "nap", "nds",
1321                                                 "nds-nl", "nl", "nn", "no", "non", "nv", "oc", "or", "os", "pa",
1322                                                 "pl", "pms", "ps", "pt", "pt-br", "qu", "rmy", "ro", "ru", "sc",
1323                                                 "sd", "sk", "sl", "sq", "sr", "sr-ec", "sr-el",
1324                                                 "su", "sv", "ta", "te", "th", "tr", "tt", "ty", "tyv", "udm",
1325                                                 "ug", "uk", "ur", "utf8", "vec", "vi", "wa", "xal", "yi", "za",
1326                                                 "zh", "zh-cn", "zh-hk", "zh-sg", "zh-tw", "zh-tw" ) ),
1327                                 "returnto"       => wikiFuzz::makeFuzz( 2 ),
1328                                 "feed"           => wikiFuzz::chooseInput( array( "atom", "rss", wikiFuzz::makeFuzz( 2 ) ) ),
1329                                 "rcid"           => wikiFuzz::makeFuzz( 2 ),
1330                                 "action"         => wikiFuzz::chooseInput( array( "view", "raw", "render", wikiFuzz::makeFuzz( 2 ), "markpatrolled" ) ),
1331                                 "printable"      => wikiFuzz::makeFuzz( 2 ),
1332                                 "oldid"          => wikiFuzz::makeFuzz( 2 ),
1333                                 "redirect"       => wikiFuzz::makeFuzz( 2 ),
1334                                 "diff"           => wikiFuzz::makeFuzz( 2 ),
1335                                 "search"         => wikiFuzz::makeFuzz( 2 ),
1336                                 "rdfrom"         => wikiFuzz::makeFuzz( 2 ),  // things from Article.php from here on:
1337                                 "token"          => wikiFuzz::makeFuzz( 2 ),
1338                                 "tbid"           => wikiFuzz::makeFuzz( 2 ),
1339                                 "action"         => wikiFuzz::chooseInput( array( "purge", wikiFuzz::makeFuzz( 2 ) ) ),
1340                                 "wpReason"       => wikiFuzz::makeFuzz( 2 ),
1341                                 "wpEditToken"    => wikiFuzz::makeFuzz( 2 ),
1342                                 "from"           => wikiFuzz::makeFuzz( 2 ),
1343                                 "bot"            => wikiFuzz::makeFuzz( 2 ),
1344                                 "summary"        => wikiFuzz::makeFuzz( 2 ),
1345                                 "direction"      => wikiFuzz::chooseInput( array( "next", "prev", wikiFuzz::makeFuzz( 2 ) ) ),
1346                                 "section"        => wikiFuzz::makeFuzz( 2 ),
1347                                 "preload"        => wikiFuzz::makeFuzz( 2 ),
1348
1349                                 );
1350
1351                 // Tidy does not know how to valid atom or rss, so exclude from testing for the time being.
1352                 if ( $this->params["feed"] == "atom" )     { unset( $this->params["feed"] ); }
1353                 else if ( $this->params["feed"] == "rss" ) { unset( $this->params["feed"] ); }
1354
1355                 // Raw pages cannot really be validated
1356                 if ( $this->params["action"] == "raw" ) unset( $this->params["action"] );
1357
1358                 // sometimes we don't want to specify certain parameters.
1359                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["rcid"] );
1360                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["diff"] );
1361                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["rdfrom"] );
1362                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["oldid"] );
1363
1364                 // usually don't want action == purge.
1365                 if ( wikiFuzz::randnum( 6 ) > 1 ) unset( $this->params["action"] );
1366         }
1367 }
1368
1369
1370 /**
1371  ** a page test for "Special:Allmessages".
1372  */
1373 class specialAllmessagesTest extends pageTest {
1374         function __construct() {
1375                 $this->pagePath = "index.php?title=Special:Allmessages";
1376
1377                 // only really has one parameter
1378                 $this->params = array (
1379                                 "ot"     => wikiFuzz::chooseInput( array( "php", "html", wikiFuzz::makeFuzz( 2 ) ) )
1380                                 );
1381         }
1382 }
1383
1384 /**
1385  ** a page test for "Special:Newpages".
1386  */
1387 class specialNewpages extends pageTest {
1388         function __construct() {
1389                 $this->pagePath = "index.php?title=Special:Newpages";
1390
1391                 $this->params = array (
1392                                 "namespace" => wikiFuzz::chooseInput( range( -1, 15 ) ),
1393                                 "feed"      => wikiFuzz::chooseInput( array( "atom", "rss", wikiFuzz::makeFuzz( 2 ) ) ),
1394                                 'limit'     => wikiFuzz::chooseInput( array( "-1", "0", "-------'------0", "+1", "8134",  wikiFuzz::makeFuzz( 2 ) ) ),
1395                                 'offset'    => wikiFuzz::chooseInput( array( "-1", "0", "------'-------0", "+1", "9823412312312412435", wikiFuzz::makeFuzz( 2 ) ) )
1396                                 );
1397
1398                 // Tidy does not know how to valid atom or rss, so exclude from testing for the time being.
1399                 if ( $this->params["feed"] == "atom" )     { unset( $this->params["feed"] ); }
1400                 else if ( $this->params["feed"] == "rss" ) { unset( $this->params["feed"] ); }
1401         }
1402 }
1403
1404 /**
1405  ** a page test for "redirect.php"
1406  */
1407 class redirectTest extends pageTest {
1408         function __construct() {
1409                 $this->pagePath = "redirect.php";
1410
1411                 $this->params = array (
1412                                 "wpDropdown" => wikiFuzz::makeFuzz( 2 )
1413                                 );
1414
1415                 // sometimes we don't want to specify certain parameters.
1416                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpDropdown"] );
1417         }
1418 }
1419
1420
1421 /**
1422  ** a page test for "Special:Confirmemail"
1423  */
1424 class confirmEmail extends pageTest {
1425         function __construct() {
1426                 // sometimes we send a bogus confirmation code, and sometimes we don't.
1427                 $this->pagePath = "index.php?title=Special:Confirmemail" . wikiFuzz::chooseInput( array( "", "/" . wikiFuzz::makeTitleSafe( wikiFuzz::makeFuzz( 1 ) ) ) );
1428
1429                 $this->params = array (
1430                                 "token" => wikiFuzz::makeFuzz( 2 )
1431                                 );
1432         }
1433 }
1434
1435
1436 /**
1437  ** a page test for "Special:Watchlist"
1438  **        Note: this test would be better if we were logged in.
1439  */
1440 class watchlistTest extends pageTest {
1441         function __construct() {
1442                 $this->pagePath = "index.php?title=Special:Watchlist";
1443
1444                 $this->params = array (
1445                                 "remove"   => wikiFuzz::chooseInput( array( "Remove checked items from watchlist", wikiFuzz::makeFuzz( 2 ) ) ),
1446                                 'days'     => wikiFuzz::chooseInput( array( 0, -1, -230, "--", 3, 9, wikiFuzz::makeFuzz( 2 ) ) ),
1447                                 'hideOwn'  => wikiFuzz::chooseInput( array( "", "0", "1", wikiFuzz::makeFuzz( 2 ) ) ),
1448                                 'hideBots' => wikiFuzz::chooseInput( array( "", "0", "1", wikiFuzz::makeFuzz( 2 ) ) ),
1449                                 'namespace' => wikiFuzz::chooseInput( array( "", "0", "1", wikiFuzz::makeFuzz( 2 ) ) ),
1450                                 'action'   => wikiFuzz::chooseInput( array( "submit", "clear", wikiFuzz::makeFuzz( 2 ) ) ),
1451                                 'id[]'     => wikiFuzz::makeFuzz( 2 ),
1452                                 'edit'     => wikiFuzz::makeFuzz( 2 ),
1453                                 'token'    => wikiFuzz::chooseInput( array( "", "1243213", wikiFuzz::makeFuzz( 2 ) ) )
1454                                 );
1455
1456                 // sometimes we specifiy "reset", and sometimes we don't.
1457                 if ( wikiFuzz::randnum( 3 ) == 0 ) $this->params["reset"] = wikiFuzz::chooseInput( array( "", "0", "1", wikiFuzz::makeFuzz( 2 ) ) );
1458         }
1459 }
1460
1461
1462 /**
1463  ** a page test for "Special:Blockme"
1464  */
1465 class specialBlockmeTest extends pageTest {
1466         function __construct() {
1467                 $this->pagePath = "index.php?title=Special:Blockme";
1468
1469                 $this->params = array ( );
1470
1471                 // sometimes we specify "ip", and sometimes we don't.
1472                 if ( wikiFuzz::randnum( 1 ) == 0 ) {
1473                         $this->params["ip"] = wikiFuzz::chooseInput( array( "10.12.41.213", wikiFuzz::randnum( -10, 8134 ), wikiFuzz::makeFuzz( 2 ) ) );
1474                 }
1475         }
1476 }
1477
1478
1479 /**
1480  ** a page test for "Special:Movepage"
1481  */
1482 class specialMovePage extends pageTest {
1483         function __construct() {
1484                 $this->pagePath = "index.php?title=Special:Movepage";
1485
1486                 $this->params = array (
1487                                 "action"      => wikiFuzz::chooseInput( array( "success", "submit", "", wikiFuzz::makeFuzz( 2 ) ) ),
1488                                 'wpEditToken' => wikiFuzz::chooseInput( array( '', 0, 34987987, wikiFuzz::makeFuzz( 2 ) ) ),
1489                                 'target'      => wikiFuzz::chooseInput( array( "x", wikiFuzz::makeTitleSafe( wikiFuzz::makeFuzz( 2 ) ) ) ),
1490                                 'wpOldTitle'  => wikiFuzz::chooseInput( array( "z", wikiFuzz::makeTitleSafe( wikiFuzz::makeFuzz( 2 ) ), wikiFuzz::makeFuzz( 2 ) ) ),
1491                                 'wpNewTitle'  => wikiFuzz::chooseInput( array( "y", wikiFuzz::makeTitleSafe( wikiFuzz::makeFuzz( 2 ) ), wikiFuzz::makeFuzz( 2 ) ) ),
1492                                 'wpReason'    => wikiFuzz::chooseInput( array( wikiFuzz::makeFuzz( 2 ) ) ),
1493                                 'wpMovetalk'  => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1494                                 'wpDeleteAndMove'  => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1495                                 'wpConfirm'   => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1496                                 'talkmoved'   => wikiFuzz::chooseInput( array( "1", wikiFuzz::makeFuzz( 2 ), "articleexists", 'notalkpage' ) ),
1497                                 'oldtitle'    => wikiFuzz::makeFuzz( 2 ),
1498                                 'newtitle'    => wikiFuzz::makeFuzz( 2 ),
1499                                 'wpMovetalk'  => wikiFuzz::chooseInput( array( "1", "0", wikiFuzz::makeFuzz( 2 ) ) )
1500                                 );
1501
1502                 // sometimes we don't want to specify certain parameters.
1503                 if ( wikiFuzz::randnum( 2 ) == 0 ) unset( $this->params["wpEditToken"] );
1504                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["target"] );
1505                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["wpNewTitle"] );
1506                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpReason"] );
1507                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpOldTitle"] );
1508         }
1509 }
1510
1511
1512 /**
1513  ** a page test for "Special:Undelete"
1514  */
1515 class specialUndelete extends pageTest {
1516         function __construct() {
1517                 $this->pagePath = "index.php?title=Special:Undelete";
1518
1519                 $this->params = array (
1520                                 "action"      => wikiFuzz::chooseInput( array( "submit", "", wikiFuzz::makeFuzz( 2 ) ) ),
1521                                 'wpEditToken' => wikiFuzz::chooseInput( array( '', 0, 34987987, wikiFuzz::makeFuzz( 2 ) ) ),
1522                                 'target'      => wikiFuzz::chooseInput( array( "x", wikiFuzz::makeTitleSafe( wikiFuzz::makeFuzz( 2 ) ) ) ),
1523                                 'timestamp'   => wikiFuzz::chooseInput( array( "125223", wikiFuzz::makeFuzz( 2 ) ) ),
1524                                 'file'        => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1525                                 'restore'     => wikiFuzz::chooseInput( array( "0", "1", wikiFuzz::makeFuzz( 2 ) ) ),
1526                                 'preview'     => wikiFuzz::chooseInput( array( "0", "1", wikiFuzz::makeFuzz( 2 ) ) ),
1527                                 'wpComment'   => wikiFuzz::makeFuzz( 2 )
1528                                 );
1529
1530                 // sometimes we don't want to specify certain parameters.
1531                 if ( wikiFuzz::randnum( 2 ) == 0 ) unset( $this->params["wpEditToken"] );
1532                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["target"] );
1533                 if ( wikiFuzz::randnum( 1 ) == 0 ) unset( $this->params["restore"] );
1534                 if ( wikiFuzz::randnum( 1 ) == 0 ) unset( $this->params["preview"] );
1535         }
1536 }
1537
1538
1539 /**
1540  ** a page test for "Special:Unlockdb"
1541  */
1542 class specialUnlockdb extends pageTest {
1543         function __construct() {
1544                 $this->pagePath = "index.php?title=Special:Unlockdb";
1545
1546                 $this->params = array (
1547                                 "action"        => wikiFuzz::chooseInput( array( "submit", "success", "", wikiFuzz::makeFuzz( 2 ) ) ),
1548                                 'wpEditToken'   => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1549                                 'wpLockConfirm' => wikiFuzz::chooseInput( array( "0", "1", wikiFuzz::makeFuzz( 2 ) ) )
1550                                 );
1551
1552                 // sometimes we don't want to specify certain parameters.
1553                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpEditToken"] );
1554                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["action"] );
1555                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpLockConfirm"] );
1556         }
1557 }
1558
1559
1560 /**
1561  ** a page test for "Special:Lockdb"
1562  */
1563 class specialLockdb extends pageTest {
1564         function __construct() {
1565                 $this->pagePath = "index.php?title=Special:Lockdb";
1566
1567                 $this->params = array (
1568                                 "action"       => wikiFuzz::chooseInput( array( "submit", "success", "", wikiFuzz::makeFuzz( 2 ) ) ),
1569                                 'wpEditToken'  => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1570                                 'wpLockReason' => wikiFuzz::makeFuzz( 2 ),
1571                                 'wpLockConfirm' => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) )
1572                                 );
1573
1574                 // sometimes we don't want to specify certain parameters.
1575                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpEditToken"] );
1576                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["action"] );
1577                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpLockConfirm"] );
1578         }
1579 }
1580
1581
1582 /**
1583  ** a page test for "Special:Userrights"
1584  */
1585 class specialUserrights extends pageTest {
1586         function __construct() {
1587                 $this->pagePath = "index.php?title=Special:Userrights";
1588
1589                 $this->params = array (
1590                                 'wpEditToken'   => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1591                                 'user-editname' => wikiFuzz::chooseInput( array( "Nickj2", "Nickj2\n<xyz>", wikiFuzz::makeFuzz( 2 ) ) ),
1592                                 'ssearchuser'   => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1593                                 'saveusergroups' => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ), "Save User Groups" ),
1594                                 'member[]'      => wikiFuzz::chooseInput( array( "0", "bot", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1595                                 "available[]"   => wikiFuzz::chooseInput( array( "0", "sysop", "bureaucrat", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) )
1596                                 );
1597
1598                 // sometimes we don't want to specify certain parameters.
1599                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params['ssearchuser'] );
1600                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params['saveusergroups'] );
1601         }
1602 }
1603
1604
1605 /**
1606  ** a test for page protection and unprotection.
1607  */
1608 class pageProtectionForm extends pageTest {
1609         function __construct() {
1610                 $this->pagePath = "index.php?title=Main_Page";
1611
1612                 $this->params = array (
1613                                 "action"               => "protect",
1614                                 'wpEditToken'          => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1615                                 "mwProtect-level-edit" => wikiFuzz::chooseInput( array( '', 'autoconfirmed', 'sysop', wikiFuzz::makeFuzz( 2 ) ) ),
1616                                 "mwProtect-level-move" => wikiFuzz::chooseInput( array( '', 'autoconfirmed', 'sysop', wikiFuzz::makeFuzz( 2 ) ) ),
1617                                 "mwProtectUnchained"   => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1618                                 'mwProtect-reason'     => wikiFuzz::chooseInput( array( "because it was there", wikiFuzz::makeFuzz( 2 ) ) )
1619                                 );
1620
1621
1622                 // sometimes we don't want to specify certain parameters.
1623                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["mwProtectUnchained"] );
1624                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params['mwProtect-reason'] );
1625         }
1626 }
1627
1628
1629 /**
1630  ** a page test for "Special:Blockip".
1631  */
1632 class specialBlockip extends pageTest {
1633         function __construct() {
1634                 $this->pagePath = "index.php?title=Special:Blockip";
1635
1636                 $this->params = array (
1637                                 "action"          => wikiFuzz::chooseInput( array( "submit", "",  wikiFuzz::makeFuzz( 2 ) ) ),
1638                                 'wpEditToken'     => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1639                                 "wpBlockAddress"  => wikiFuzz::chooseInput( array( "20398702394", "", "Nickj2", wikiFuzz::makeFuzz( 2 ),
1640                                                                           // something like an IP address, sometimes invalid:
1641                                                                          ( wikiFuzz::randnum( 300, -20 ) . "." . wikiFuzz::randnum( 300, -20 ) . "."
1642                                                                           . wikiFuzz::randnum( 300, -20 ) . "." . wikiFuzz::randnum( 300, -20 ) ) ) ),
1643                                 "ip"              => wikiFuzz::chooseInput( array( "20398702394", "", "Nickj2", wikiFuzz::makeFuzz( 2 ),
1644                                                                           // something like an IP address, sometimes invalid:
1645                                                                          ( wikiFuzz::randnum( 300, -20 ) . "." . wikiFuzz::randnum( 300, -20 ) . "."
1646                                                                           . wikiFuzz::randnum( 300, -20 ) . "." . wikiFuzz::randnum( 300, -20 ) ) ) ),
1647                                 "wpBlockOther"    => wikiFuzz::chooseInput( array( '', 'Nickj2', wikiFuzz::makeFuzz( 2 ) ) ),
1648                                 "wpBlockExpiry"   => wikiFuzz::chooseInput( array( "other", "2 hours", "1 day", "3 days", "1 week", "2 weeks",
1649                                                                                   "1 month", "3 months", "6 months", "1 year", "infinite", wikiFuzz::makeFuzz( 2 ) ) ),
1650                                 "wpBlockReason"   => wikiFuzz::chooseInput( array( "because it was there", wikiFuzz::makeFuzz( 2 ) ) ),
1651                                 "wpAnonOnly"      => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1652                                 "wpCreateAccount" => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1653                                 "wpBlock"         => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) )
1654                                 );
1655
1656                 // sometimes we don't want to specify certain parameters.
1657                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpBlockOther"] );
1658                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpBlockExpiry"] );
1659                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpBlockReason"] );
1660                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpAnonOnly"] );
1661                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpCreateAccount"] );
1662                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["wpBlockAddress"] );
1663                 if ( wikiFuzz::randnum( 4 ) == 0 ) unset( $this->params["ip"] );
1664         }
1665 }
1666
1667
1668 /**
1669  ** a test for the imagepage.
1670  */
1671 class imagepageTest extends pageTest {
1672         function __construct() {
1673                 $this->pagePath = "index.php?title=Image:Small-email.png";
1674
1675                 $this->params = array (
1676                                 "image"         => wikiFuzz::chooseInput( array( "Small-email.png", wikiFuzz::makeFuzz( 2 ) ) ),
1677                                 "wpReason"      => wikiFuzz::makeFuzz( 2 ),
1678                                 "oldimage"      => wikiFuzz::chooseInput( array( "Small-email.png", wikiFuzz::makeFuzz( 2 ) ) ),
1679                                 "wpEditToken"   => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1680                                 );
1681
1682                 // sometimes we don't want to specify certain parameters.
1683                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["image"] );
1684                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpReason"] );
1685                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["oldimage"] );
1686                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpEditToken"] );
1687         }
1688 }
1689
1690
1691 /**
1692  ** a test for page deletion form.
1693  */
1694 class pageDeletion extends pageTest {
1695         function __construct() {
1696                 $this->pagePath = "index.php?title=Main_Page&action=delete";
1697
1698                 $this->params = array (
1699                                 "wpEditToken" => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1700                                 "wpReason"    => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1701                                 "wpConfirm"   => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1702                                 );
1703
1704                 // sometimes we don't want to specify certain parameters.
1705                 if ( wikiFuzz::randnum( 5 ) == 0 ) unset( $this->params["wpReason"] );
1706                 if ( wikiFuzz::randnum( 5 ) == 0 ) unset( $this->params["wpEditToken"] );
1707                 if ( wikiFuzz::randnum( 5 ) == 0 ) unset( $this->params["wpConfirm"] );
1708         }
1709 }
1710
1711
1712
1713 /**
1714  ** a test for Revision Deletion.
1715  */
1716 class specialRevisionDelete extends pageTest {
1717         function __construct() {
1718                 $this->pagePath = "index.php?title=Special:Revisiondelete";
1719
1720                 $this->params = array (
1721                                 "target"               => wikiFuzz::chooseInput( array( "Main Page", wikiFuzz::makeFuzz( 2 ) ) ),
1722                                 "oldid"                => wikiFuzz::makeFuzz( 2 ),
1723                                 "oldid[]"              => wikiFuzz::makeFuzz( 2 ),
1724                                 "wpReason"             => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1725                                 "revdelete-hide-text"  => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1726                                 "revdelete-hide-comment" => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1727                                 "revdelete-hide-user"  => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1728                                 "revdelete-hide-restricted" => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1729                                 );
1730
1731                 // sometimes we don't want to specify certain parameters.
1732                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["target"] );
1733                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["oldid"] );
1734                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["oldid[]"] );
1735                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["wpReason"] );
1736                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["revdelete-hide-text"] );
1737                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["revdelete-hide-comment"] );
1738                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["revdelete-hide-user"] );
1739                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["revdelete-hide-restricted"] );
1740         }
1741 }
1742
1743
1744 /**
1745  ** a test for Special:Import.
1746  */
1747 class specialImport extends pageTest {
1748         function __construct() {
1749                 $this->pagePath = "index.php?title=Special:Import";
1750
1751                 $this->params = array (
1752                                 "action"         => "submit",
1753                                 "source"         => wikiFuzz::chooseInput( array( "upload", "interwiki", wikiFuzz::makeFuzz( 2 ) ) ),
1754                                 "MAX_FILE_SIZE"  => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1755                                 "xmlimport"      => wikiFuzz::chooseInput( array( "/var/www/hosts/mediawiki/wiki/AdminSettings.php", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1756                                 "namespace"      => wikiFuzz::chooseInput( array( wikiFuzz::randnum( 30, -6 ), wikiFuzz::makeFuzz( 2 ) ) ),
1757                                 "interwiki"      => wikiFuzz::makeFuzz( 2 ),
1758                                 "interwikiHistory" => wikiFuzz::makeFuzz( 2 ),
1759                                 "frompage"       => wikiFuzz::makeFuzz( 2 ),
1760                                 );
1761
1762                 // sometimes we don't want to specify certain parameters.
1763                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["action"] );
1764                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["source"] );
1765                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["MAX_FILE_SIZE"] );
1766                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["xmlimport"] );
1767                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["interwiki"] );
1768                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["interwikiHistory"] );
1769                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["frompage"] );
1770
1771                 // Note: Need to do a file upload to fully test this Special page.
1772         }
1773 }
1774
1775
1776 /**
1777  ** a test for thumb.php
1778  */
1779 class thumbTest extends pageTest {
1780         function __construct() {
1781                 $this->pagePath = "thumb.php";
1782
1783                 $this->params = array (
1784                                 "f"  => wikiFuzz::chooseInput( array( "..", "\\", "small-email.png", wikiFuzz::makeFuzz( 2 ) ) ),
1785                                 "w"  => wikiFuzz::chooseInput( array( "80", wikiFuzz::randnum( 6000, -200 ), wikiFuzz::makeFuzz( 2 ) ) ),
1786                                 "r"  => wikiFuzz::chooseInput( array( "0", wikiFuzz::makeFuzz( 2 ) ) ),
1787                                 );
1788
1789                 // sometimes we don't want to specify certain parameters.
1790                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["f"] );
1791                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["w"] );
1792                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["r"] );
1793         }
1794 }
1795
1796
1797 /**
1798  ** a test for trackback.php
1799  */
1800 class trackbackTest extends pageTest {
1801         function __construct() {
1802                 $this->pagePath = "trackback.php";
1803
1804                 $this->params = array (
1805                                 "url"       => wikiFuzz::makeFuzz( 2 ),
1806                                 "blog_name" => wikiFuzz::chooseInput( array( "80", wikiFuzz::randnum( 6000, -200 ), wikiFuzz::makeFuzz( 2 ) ) ),
1807                                 "article"   => wikiFuzz::chooseInput( array( "Main Page", wikiFuzz::makeFuzz( 2 ) ) ),
1808                                 "title"     => wikiFuzz::chooseInput( array( "Main Page", wikiFuzz::makeFuzz( 2 ) ) ),
1809                                 "excerpt"   => wikiFuzz::makeFuzz( 2 ),
1810                                 );
1811
1812                 // sometimes we don't want to specify certain parameters.
1813                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["title"] );
1814                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["excerpt"] );
1815
1816                 // page does not produce HTML.
1817                 $this->tidyValidate = false;
1818         }
1819 }
1820
1821
1822 /**
1823  ** a test for profileinfo.php
1824  */
1825 class profileInfo extends pageTest {
1826         function __construct() {
1827                 $this->pagePath = "profileinfo.php";
1828
1829                 $this->params = array (
1830                                 "expand"  => wikiFuzz::makeFuzz( 2 ),
1831                                 "sort"    => wikiFuzz::chooseInput( array( "time", "count", "name", wikiFuzz::makeFuzz( 2 ) ) ),
1832                                 "filter"  => wikiFuzz::chooseInput( array( "Main Page", wikiFuzz::makeFuzz( 2 ) ) ),
1833                                 );
1834
1835                 // sometimes we don't want to specify certain parameters.
1836                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["sort"] );
1837                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["filter"] );
1838         }
1839 }
1840
1841
1842 /**
1843  ** a test for Special:Cite (extension Special page).
1844  */
1845 class specialCite extends pageTest {
1846         function __construct() {
1847                 $this->pagePath = "index.php?title=Special:Cite";
1848
1849                 $this->params = array (
1850                                 "page"    => wikiFuzz::chooseInput( array( "\" onmouseover=\"alert(1);\"", "Main Page", wikiFuzz::makeFuzz( 2 ) ) ),
1851                                 "id"      => wikiFuzz::chooseInput( array( "-1", "0", "------'-------0", "+1", "-9823412312312412435", wikiFuzz::makeFuzz( 2 ) ) ),
1852                                 );
1853
1854                 // sometimes we don't want to specify certain parameters.
1855                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["page"] );
1856                 if ( wikiFuzz::randnum( 6 ) == 0 ) unset( $this->params["id"] );
1857         }
1858 }
1859
1860
1861 /**
1862  ** a test for Special:Filepath (extension Special page).
1863  */
1864 class specialFilepath extends pageTest {
1865         function __construct() {
1866                 $this->pagePath = "index.php?title=Special:Filepath";
1867
1868                 $this->params = array (
1869                                 "file"    => wikiFuzz::chooseInput( array( "Small-email.png", "Small-email.png" . wikiFuzz::makeFuzz( 1 ), wikiFuzz::makeFuzz( 2 ) ) ),
1870                                 );
1871         }
1872 }
1873
1874
1875 /**
1876  ** a test for Special:Makebot (extension Special page).
1877  */
1878 class specialMakebot extends pageTest {
1879         function __construct() {
1880                 $this->pagePath = "index.php?title=Special:Makebot";
1881
1882                 $this->params = array (
1883                                 "username" => wikiFuzz::chooseInput( array( "Nickj2", "192.168.0.2", wikiFuzz::makeFuzz( 1 ) ) ),
1884                                 "dosearch" => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1885                                 "grant"    => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1886                                 "comment"  => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1887                                 "token"    => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1888                                 );
1889
1890                 // sometimes we don't want to specify certain parameters.
1891                 if ( wikiFuzz::randnum( 2 ) == 0 ) unset( $this->params["dosearch"] );
1892                 if ( wikiFuzz::randnum( 2 ) == 0 ) unset( $this->params["grant"] );
1893                 if ( wikiFuzz::randnum( 5 ) == 0 ) unset( $this->params["token"] );
1894         }
1895 }
1896
1897
1898 /**
1899  ** a test for Special:Makesysop (extension Special page).
1900  */
1901 class specialMakesysop extends pageTest {
1902         function __construct() {
1903                 $this->pagePath = "index.php?title=Special:Makesysop";
1904
1905                 $this->params = array (
1906                                 "wpMakesysopUser"   => wikiFuzz::chooseInput( array( "Nickj2", "192.168.0.2", wikiFuzz::makeFuzz( 1 ) ) ),
1907                                 "action"            => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1908                                 "wpMakesysopSubmit" => wikiFuzz::chooseInput( array( "0", "1", "++--34234", wikiFuzz::makeFuzz( 2 ) ) ),
1909                                 "wpEditToken"       => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1910                                 "wpSetBureaucrat"   => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1911                                 );
1912
1913                 // sometimes we don't want to specify certain parameters.
1914                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["wpMakesysopSubmit"] );
1915                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["wpEditToken"] );
1916                 if ( wikiFuzz::randnum( 3 ) == 0 ) unset( $this->params["wpSetBureaucrat"] );
1917         }
1918 }
1919
1920
1921 /**
1922  ** a test for Special:Renameuser (extension Special page).
1923  */
1924 class specialRenameuser extends pageTest {
1925         function __construct() {
1926                 $this->pagePath = "index.php?title=Special:Renameuser";
1927
1928                 $this->params = array (
1929                                 "oldusername"   => wikiFuzz::chooseInput( array( "Nickj2", "192.168.0.2", wikiFuzz::makeFuzz( 1 ) ) ),
1930                                 "newusername"   => wikiFuzz::chooseInput( array( "Nickj2", "192.168.0.2", wikiFuzz::makeFuzz( 1 ) ) ),
1931                                 "token"         => wikiFuzz::chooseInput( array( "20398702394", "", wikiFuzz::makeFuzz( 2 ) ) ),
1932                                 );
1933         }
1934 }
1935
1936
1937 /**
1938  ** a test for Special:Linksearch (extension Special page).
1939  */
1940 class specialLinksearch extends pageTest {
1941         function __construct() {
1942                 $this->pagePath = "index.php?title=Special%3ALinksearch";
1943
1944                 $this->params = array (
1945                                 "target" => wikiFuzz::makeFuzz( 2 ),
1946                                 );
1947
1948                 // sometimes we don't want to specify certain parameters.
1949                 if ( wikiFuzz::randnum( 10 ) == 0 ) unset( $this->params["target"] );
1950         }
1951 }
1952
1953
1954 /**
1955  ** a test for Special:CategoryTree (extension Special page).
1956  */
1957 class specialCategoryTree extends pageTest {
1958         function __construct() {
1959                 $this->pagePath = "index.php?title=Special:CategoryTree";
1960
1961                 $this->params = array (
1962                                 "target" => wikiFuzz::makeFuzz( 2 ),
1963                                 "from"   => wikiFuzz::makeFuzz( 2 ),
1964                                 "until"  => wikiFuzz::makeFuzz( 2 ),
1965                                 "showas" => wikiFuzz::makeFuzz( 2 ),
1966                                 "mode"   => wikiFuzz::chooseInput( array( "pages", "categories", "all", wikiFuzz::makeFuzz( 2 ) ) ),
1967                                 );
1968
1969                 // sometimes we do want to specify certain parameters.
1970                 if ( wikiFuzz::randnum( 5 ) == 0 ) $this->params["notree"] = wikiFuzz::chooseInput( array( "1", 0, "", wikiFuzz::makeFuzz( 2 ) ) );
1971         }
1972 }
1973
1974
1975 /**
1976  ** a test for "Special:Chemicalsources" (extension Special page).
1977  */
1978 class specialChemicalsourcesTest extends pageTest {
1979         function __construct() {
1980                 $this->pagePath = "index.php?title=Special:Chemicalsources";
1981
1982                 // choose an input format to use.
1983                 $format =  wikiFuzz::chooseInput(
1984                                         array(  'go',
1985                                                         'CAS',
1986                                                         'EINECS',
1987                                                         'CHEBI',
1988                                                         'PubChem',
1989                                                         'SMILES',
1990                                                         'InChI',
1991                                                         'ATCCode',
1992                                                         'KEGG',
1993                                                         'RTECS',
1994                                                         'ECNumber',
1995                                                         'DrugBank',
1996                                                         'Formula',
1997                                                         'Name'
1998                                                  )
1999                                         );
2000
2001                 // values for different formats usually start with either letters or numbers.
2002                 switch ( $format ) {
2003                         case 'Name'   : $value = "A"; break;
2004                         case 'InChI'  :
2005                         case 'SMILES' :
2006                         case 'Formula': $value = "C"; break;
2007                         default       : $value = "0"; break;
2008                 }
2009
2010                 // and then we append the fuzz input.
2011                 $this->params = array ( $format => $value . wikiFuzz::makeFuzz( 2 ) );
2012         }
2013 }
2014
2015
2016 /**
2017  ** A test for api.php (programmatic interface to MediaWiki in XML/JSON/RSS/etc formats).
2018  ** Quite involved to test because there are lots of options/parameters, and because
2019  ** for a lot of the functionality if all the parameters don't make sense then it just
2020  ** returns the help screen - so currently a lot of the tests aren't actually doing much
2021  ** because something wasn't right in the query.
2022  **
2023  ** @todo: Incomplete / unfinished; Runs too fast (suggests not much testing going on).
2024  */
2025 class api extends pageTest {
2026
2027         // API login mode.
2028         private static function loginMode() {
2029                 $arr =  array ( "lgname"        => wikiFuzz::makeFuzz( 2 ),
2030                                                 "lgpassword"    => wikiFuzz::makeFuzz( 2 ),
2031                                            );
2032                 // sometimes we want to specify the extra "lgdomain" parameter.
2033                 if ( wikiFuzz::randnum( 3 ) == 0 ) {
2034                         $arr["lgdomain"] = wikiFuzz::chooseInput( array( "1", 0, "", wikiFuzz::makeFuzz( 2 ) ) );
2035                 }
2036
2037                 return $arr;
2038         }
2039
2040         // API OpenSearch mode.
2041         private static function opensearchMode() {
2042                 return array ( "search"        => wikiFuzz::makeFuzz( 2 ) );
2043         }
2044
2045         // API watchlist feed mode.
2046         private static function feedwatchlistMode() {
2047                 // FIXME: add "wikiFuzz::makeFuzz(2)" as possible value below?
2048                 return array ( "feedformat"    => wikiFuzz::chooseInput( array( "rss", "atom" ) ) );
2049         }
2050
2051         // API query mode.
2052         private static function queryMode() {
2053                 // FIXME: add "wikiFuzz::makeFuzz(2)" as possible params for the elements below?
2054                 //        Suspect this will stuff up the tests more, but need to check.
2055                 $params = array (
2056                                          // FIXME: More titles.
2057                                          "titles"        => wikiFuzz::chooseInput( array( "Main Page" ) ),
2058                                          // FIXME: More pageids.
2059                                          "pageids"       => 1,
2060                                          "prop"          => wikiFuzz::chooseInput( array( "info", "revisions", "watchlist" ) ),
2061                                          "list"          => wikiFuzz::chooseInput( array( "allpages", "logevents", "watchlist", "usercontribs", "recentchanges", "backlinks", "embeddedin", "imagelinks" ) ),
2062                                          "meta"          => wikiFuzz::chooseInput( array( "siteinfo" ) ),
2063                                          "generator"     => wikiFuzz::chooseInput( array( "allpages", "logevents", "watchlist", "info", "revisions" ) ),
2064                                          "siprop"        => wikiFuzz::chooseInput( array( "general", "namespaces", "general|namespaces" ) ),
2065                                    );
2066
2067                  // Add extra parameters based on what list choice we got.
2068                  switch ( $params["list"] ) {
2069                         case "usercontribs" : self::addListParams ( $params, "uc", array( "limit", "start", "end", "user", "dir" ) ); break;
2070                         case "allpages"     : self::addListParams ( $params, "ap", array( "from", "prefix", "namespace", "filterredir", "limit" ) ); break;
2071                         case "watchlist"    : self::addListParams ( $params, "wl", array( "allrev", "start", "end", "namespace", "dir", "limit", "prop" ) ); break;
2072                         case "logevents"    : self::addListParams ( $params, "le", array( "limit", "type", "start", "end", "user", "dir" ) ); break;
2073                         case "recentchanges": self::addListParams ( $params, "rc", array( "limit", "prop", "show", "namespace", "start", "end", "dir" ) ); break;
2074                         case "backlinks"    : self::addListParams ( $params, "bl", array( "continue", "namespace", "redirect", "limit" ) ); break;
2075                         case "embeddedin"   : self::addListParams ( $params, "ei", array( "continue", "namespace", "redirect", "limit" ) ); break;
2076                         case "imagelinks"   : self::addListParams ( $params, "il", array( "continue", "namespace", "redirect", "limit" ) ); break;
2077                  }
2078
2079                  if ( $params["prop"] == "revisions" ) {
2080                         self::addListParams ( $params, "rv", array( "prop", "limit", "startid", "endid", "end", "dir" ) );
2081                  }
2082
2083                  // Sometimes we want redirects, sometimes we don't.
2084                  if ( wikiFuzz::randnum( 3 ) == 0 ) {
2085                         $params["redirects"] = wikiFuzz::chooseInput( array( "1", 0, "", wikiFuzz::makeFuzz( 2 ) ) );
2086                  }
2087
2088                  return $params;
2089         }
2090
2091         // Adds all the elements to the array, using the specified prefix.
2092         private static function addListParams( &$array, $prefix, $elements )  {
2093                 foreach ( $elements as $element ) {
2094                         $array[$prefix . $element] = self::getParamDetails( $element );
2095                 }
2096         }
2097
2098         // For a given element name, returns the data for that element.
2099         private static function getParamDetails( $element ) {
2100                 switch ( $element ) {
2101                         case 'startid'    :
2102                         case 'endid'      :
2103                         case 'start'      :
2104                         case 'end'        :
2105                         case 'limit'      : return wikiFuzz::chooseInput( array( "0", "-1", "---'----------0", "+1", "8134", "320742734234235", "20060230121212", wikiFuzz::randnum( 9000, -100 ), wikiFuzz::makeFuzz( 2 ) ) );
2106                         case 'dir'        : return wikiFuzz::chooseInput( array( "newer", "older", wikiFuzz::makeFuzz( 2 ) ) );
2107                         case 'user'       : return wikiFuzz::chooseInput( array( USER_ON_WIKI, wikiFuzz::makeFuzz( 2 ) ) );
2108                         case 'namespace'  : return wikiFuzz::chooseInput( array( -2, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 200000, wikiFuzz::makeFuzz( 2 ) ) );
2109                         case 'filterredir': return wikiFuzz::chooseInput( array( "all", "redirects", "nonredirectsallpages", wikiFuzz::makeFuzz( 2 ) ) );
2110                         case 'allrev'     : return wikiFuzz::chooseInput( array( "1", 0, "", wikiFuzz::makeFuzz( 2 ) ) );
2111                         case 'prop'       : return wikiFuzz::chooseInput( array( "user", "comment", "timestamp", "patrol", "flags", "user|user|comment|flags", wikiFuzz::makeFuzz( 2 ) ) );
2112                         case 'type'       : return wikiFuzz::chooseInput( array( "block", "protect", "rights", "delete", "upload", "move", "import", "renameuser", "newusers", "makebot", wikiFuzz::makeFuzz( 2 ) ) );
2113                         case 'hide'       : return wikiFuzz::chooseInput( array( "minor", "bots", "anons", "liu", "liu|bots|", wikiFuzz::makeFuzz( 2 ) ) );
2114                         case 'show'       : return wikiFuzz::chooseInput( array( 'minor', '!minor', 'bot', '!bot', 'anon', '!anon', wikiFuzz::makeFuzz( 2 ) ) );
2115                         default           : return wikiFuzz::makeFuzz( 2 );
2116                 }
2117         }
2118
2119         // Entry point.
2120         function __construct() {
2121                 $this->pagePath = "api.php";
2122
2123                 $modes = array ( "help",
2124                                                 "login",
2125                                                 "opensearch",
2126                                                 "feedwatchlist",
2127                                                 "query" );
2128                 $action = wikiFuzz::chooseInput( array_merge ( $modes, array( wikiFuzz::makeFuzz( 2 ) ) ) );
2129
2130                 switch ( $action ) {
2131                         case "login"         : $this->params = self::loginMode();
2132                                                                    break;
2133                         case "opensearch"    : $this->params = self::opensearchMode();
2134                                                                    break;
2135                         case "feedwatchlist" : $this->params = self::feedwatchlistMode();
2136                                                                    break;
2137                         case "query"         : $this->params = self::queryMode();
2138                                                                    break;
2139                         case "help"         :
2140                         default             :  // Do something random - "Crazy Ivan" mode.
2141                                                                    $random_mode = wikiFuzz::chooseInput( $modes ) . "Mode";
2142                                                                    // There is no "helpMode".
2143                                                                    if ( $random_mode == "helpMode" ) $random_mode = "queryMode";
2144                                                                    $this->params = self::$random_mode();
2145                                                                    break;
2146                 }
2147
2148                 // Save the selected action.
2149                 $this->params["action"] = $action;
2150
2151                 // Set the cookie:
2152                 // FIXME: need to get this cookie dynamically set, rather than hard-coded.
2153                 $this->cookie = "wikidbUserID=10001; wikidbUserName=Test; wikidb_session=178df0fe68c75834643af65dec9ec98a; wikidbToken=1adc6753d62c44aec950c024d7ae0540";
2154
2155                 // Output format
2156                 $this->params["format"] = wikiFuzz::chooseInput( array( "json", "jsonfm", "php", "phpfm",
2157                                                                                                                            "wddx", "wddxfm", "xml", "xmlfm",
2158                                                                                                                            "yaml", "yamlfm", "raw", "rawfm",
2159                                                                                                                            wikiFuzz::makeFuzz( 2 ) ) );
2160
2161                 // Page does not produce HTML (sometimes).
2162                 $this->tidyValidate = false;
2163         }
2164 }
2165
2166
2167 /**
2168  ** a page test for the GeSHi extension.
2169  */
2170 class GeSHi_Test extends pageTest {
2171
2172         private function getGeSHiContent() {
2173                 return "<source lang=\"" . $this->getLang() . "\" "
2174                            . ( wikiFuzz::randnum( 2 ) == 0 ? "line " : "" )
2175                            . ( wikiFuzz::randnum( 2 ) == 0 ? "strict " : "" )
2176                            . "start=" . wikiFuzz::chooseInput( array( wikiFuzz::randnum( -6000, 6000 ), wikiFuzz::makeFuzz( 2 ) ) )
2177                            . ">"
2178                            . wikiFuzz::makeFuzz( 2 )
2179                            . "</source>";
2180         }
2181
2182         private function getLang() {
2183         return wikiFuzz::chooseInput( array( "actionscript", "ada", "apache", "applescript", "asm", "asp", "autoit", "bash", "blitzbasic", "bnf", "c", "c_mac", "caddcl", "cadlisp",
2184                                 "cfdg", "cfm", "cpp", "cpp-qt", "csharp", "css", "d", "delphi", "diff", "div", "dos", "eiffel", "fortran", "freebasic", "gml", "groovy", "html4strict", "idl",
2185                                 "ini", "inno", "io", "java", "java5", "javascript", "latex", "lisp", "lua", "matlab", "mirc", "mpasm", "mysql", "nsis", "objc", "ocaml", "ocaml-brief", "oobas",
2186                                 "oracle8", "pascal", "perl", "php", "php-brief", "plsql", "python", "qbasic", "rails", "reg", "robots", "ruby", "sas", "scheme", "sdlbasic", "smalltalk", "smarty",
2187                                 "sql", "tcl", "text", "thinbasic", "tsql", "vb", "vbnet", "vhdl", "visualfoxpro", "winbatch", "xml", "xpp", "z80", wikiFuzz::makeFuzz( 1 ) ) );
2188         }
2189
2190         function __construct() {
2191                 $this->pagePath = "index.php?title=WIKIFUZZ";
2192
2193                 $this->params = array (
2194                                 "action"        => "submit",
2195                                 "wpMinoredit"   => "test",
2196                                 "wpPreview"     => "test",
2197                                 "wpSection"     => "test",
2198                                 "wpEdittime"    => "test",
2199                                 "wpSummary"     => "test",
2200                                 "wpScrolltop"   => "test",
2201                                 "wpStarttime"   => "test",
2202                                 "wpAutoSummary" => "test",
2203                                 "wpTextbox1"    => $this->getGeSHiContent() // the main wiki text, contains fake GeSHi content.
2204                                 );
2205         }
2206 }
2207
2208
2209 /**
2210  ** selects a page test to run.
2211  */
2212 function selectPageTest( $count ) {
2213
2214         // if the user only wants a specific test, then only ever give them that.
2215         if ( defined( "SPECIFIC_TEST" ) ) {
2216                 $testType = SPECIFIC_TEST;
2217                 return new $testType ();
2218         }
2219
2220         // Some of the time we test Special pages, the remaining
2221         // time we test using the standard edit page.
2222         switch ( $count % 100 ) {
2223                 case 0 : return new successfulUserLoginTest();
2224                 case 1 : return new listusersTest();
2225                 case 2 : return new searchTest();
2226                 case 3 : return new recentchangesTest();
2227                 case 4 : return new prefixindexTest();
2228                 case 5 : return new mimeSearchTest();
2229                 case 6 : return new specialLogTest();
2230                 case 7 : return new userLoginTest();
2231                 case 8 : return new ipblocklistTest();
2232                 case 9 : return new newImagesTest();
2233                 case 10: return new imagelistTest();
2234                 case 11: return new specialExportTest();
2235                 case 12: return new specialBooksourcesTest();
2236                 case 13: return new specialAllpagesTest();
2237                 case 14: return new pageHistoryTest();
2238                 case 15: return new contributionsTest();
2239                 case 16: return new viewPageTest();
2240                 case 17: return new specialAllmessagesTest();
2241                 case 18: return new specialNewpages();
2242                 case 19: return new searchTest();
2243                 case 20: return new redirectTest();
2244                 case 21: return new confirmEmail();
2245                 case 22: return new watchlistTest();
2246                 case 23: return new specialBlockmeTest();
2247                 case 24: return new specialUndelete();
2248                 case 25: return new specialMovePage();
2249                 case 26: return new specialUnlockdb();
2250                 case 27: return new specialLockdb();
2251                 case 28: return new specialUserrights();
2252                 case 29: return new pageProtectionForm();
2253                 case 30: return new specialBlockip();
2254                 case 31: return new imagepageTest();
2255                 case 32: return new pageDeletion();
2256                 case 33: return new specialRevisionDelete();
2257                 case 34: return new specialImport();
2258                 case 35: return new thumbTest();
2259                 case 36: return new trackbackTest();
2260                 case 37: return new profileInfo();
2261                 case 38: return new specialCite();
2262                 case 39: return new specialFilepath();
2263                 case 40: return new specialMakebot();
2264                 case 41: return new specialMakesysop();
2265                 case 42: return new specialRenameuser();
2266                 case 43: return new specialLinksearch();
2267                 case 44: return new specialCategoryTree();
2268                 case 45: return new api();
2269                 case 45: return new specialChemicalsourcesTest();
2270                 default: return new editPageTest();
2271         }
2272 }
2273
2274
2275 // /////////////////////  SAVING OUTPUT  /////////////////////////
2276
2277 /**
2278  ** Utility function for saving a file. Currently has no error checking.
2279  */
2280 function saveFile( $data, $name ) {
2281         file_put_contents( $name, $data );
2282 }
2283
2284
2285 /**
2286  ** Returns a test as an experimental GET-to-POST URL.
2287  **        This doesn't seem to always work though, and sometimes the output is too long
2288  **        to be a valid GET URL, so we also save in other formats.
2289  */
2290 function getAsURL( pageTest $test ) {
2291         $used_question_mark = ( strpos( $test->getPagePath(), "?" ) !== false );
2292         $retval = "http://get-to-post.nickj.org/?" . WIKI_BASE_URL . $test->getPagePath();
2293         foreach ( $test->getParams() as $param => $value ) {
2294                 if ( !$used_question_mark ) {
2295                         $retval .= "?";
2296                         $used_question_mark = true;
2297                 }
2298                 else {
2299                         $retval .= "&";
2300                 }
2301                 $retval .= $param . "=" . urlencode( $value );
2302         }
2303         return $retval;
2304 }
2305
2306
2307 /**
2308  ** Saves a plain-text human-readable version of a test.
2309  */
2310 function saveTestAsText( pageTest $test, $filename ) {
2311         $str = "Test: " . $test->getPagePath();
2312         foreach ( $test->getParams() as $param => $value ) {
2313                 $str .= "\n$param: $value";
2314         }
2315         $str .= "\nGet-to-post URL: " . getAsURL( $test ) . "\n";
2316         saveFile( $str, $filename );
2317 }
2318
2319
2320 /**
2321  ** Saves a test as a standalone basic PHP script that shows this one problem.
2322  **        Resulting script requires PHP-Curl be installed in order to work.
2323  */
2324 function saveTestAsPHP( pageTest $test, $filename ) {
2325         $str = "<?php\n"
2326                 . "\$params = " . var_export( escapeForCurl( $test->getParams() ), true ) . ";\n"
2327                 . "\$ch = curl_init();\n"
2328                 . "curl_setopt(\$ch, CURLOPT_POST, 1);\n"
2329                 . "curl_setopt(\$ch, CURLOPT_POSTFIELDS, \$params );\n"
2330                 . "curl_setopt(\$ch, CURLOPT_URL, " . var_export( WIKI_BASE_URL . $test->getPagePath(), true ) . ");\n"
2331                 . "curl_setopt(\$ch, CURLOPT_RETURNTRANSFER,1);\n"
2332                 .  ( $test->getCookie() ? "curl_setopt(\$ch, CURLOPT_COOKIE, " . var_export( $test->getCookie(), true ) . ");\n" : "" )
2333                 . "\$result=curl_exec(\$ch);\n"
2334                 . "curl_close (\$ch);\n"
2335                 . "print \$result;\n"
2336                 . "?>\n";
2337         saveFile( $str, $filename );
2338 }
2339
2340
2341 /**
2342  ** Escapes a value so that it can be used on the command line by Curl.
2343  **        Specifically, "<" and "@" need to be escaped if they are the first character,
2344  **        otherwise  curl interprets these as meaning that we want to insert a file.
2345  */
2346 function escapeForCurl( array $input_params ) {
2347         $output_params = array();
2348         foreach ( $input_params as $param => $value ) {
2349                 if ( strlen( $value ) > 0 && ( $value[0] == "@" || $value[0] == "<" ) ) {
2350                         $value = "\\" . $value;
2351                 }
2352                 $output_params[$param] = $value;
2353         }
2354         return $output_params;
2355 }
2356
2357
2358 /**
2359  ** Saves a test as a standalone CURL shell script that shows this one problem.
2360  **        Resulting script requires standalone Curl be installed in order to work.
2361  */
2362 function saveTestAsCurl( pageTest $test, $filename ) {
2363         $str = "#!/bin/bash\n"
2364                 . "curl --silent --include --globoff \\\n"
2365                 . ( $test->getCookie() ? " --cookie " . escapeshellarg( $test->getCookie() ) . " \\\n" : "" );
2366         foreach ( escapeForCurl( $test->getParams() ) as $param => $value ) {
2367                 $str .= " -F " . escapeshellarg( $param ) . "=" . escapeshellarg( $value ) . " \\\n";
2368         }
2369         $str .= " " . escapeshellarg( WIKI_BASE_URL . $test->getPagePath() ); // beginning space matters.
2370         $str .= "\n";
2371         saveFile( $str, $filename );
2372         chmod( $filename, 0755 ); // make executable
2373 }
2374
2375
2376 /**
2377  ** Saves the internal data structure to file.
2378  */
2379 function saveTestData ( pageTest $test, $filename ) {
2380         saveFile( serialize( $test ),  $filename );
2381 }
2382
2383
2384 /**
2385  ** saves a test in the various formats.
2386  */
2387 function saveTest( pageTest $test, $testname ) {
2388         $base_name = DIRECTORY . "/" . $testname;
2389         saveTestAsText( $test, $base_name . INFO_FILE );
2390         saveTestAsPHP ( $test, $base_name . PHP_TEST );
2391         saveTestAsCurl( $test, $base_name . CURL_TEST );
2392         saveTestData  ( $test, $base_name . DATA_FILE );
2393 }
2394
2395
2396 // ////////////////// MEDIAWIKI OUTPUT /////////////////////////
2397
2398 /**
2399  ** Asks MediaWiki for the HTML output of a test.
2400  */
2401 function wikiTestOutput( pageTest $test ) {
2402
2403         $ch = curl_init();
2404
2405         // specify the cookie, if required.
2406         if ( $test->getCookie() ) curl_setopt( $ch, CURLOPT_COOKIE, $test->getCookie() );
2407         curl_setopt( $ch, CURLOPT_POST, 1 );                          // save form using a POST
2408
2409         $params = escapeForCurl( $test->getParams() );
2410         curl_setopt( $ch, CURLOPT_POSTFIELDS, $params );             // load the POST variables
2411
2412         curl_setopt( $ch, CURLOPT_URL, WIKI_BASE_URL . $test->getPagePath() );  // set url to post to
2413         curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );                 // return into a variable
2414
2415         $result = curl_exec ( $ch );
2416
2417         // if we encountered an error, then say so, and return an empty string.
2418         if ( curl_error( $ch ) ) {
2419                 print "\nCurl error #: " . curl_errno( $ch ) . " - " . curl_error ( $ch );
2420                 $result = "";
2421         }
2422
2423         curl_close ( $ch );
2424
2425         return $result;
2426 }
2427
2428
2429 // ////////////////// HTML VALIDATION /////////////////////////
2430
2431 /*
2432  ** Asks the validator whether this is valid HTML, or not.
2433  */
2434 function validateHTML( $text ) {
2435
2436         $params = array ( "fragment"   => $text );
2437
2438         $ch = curl_init();
2439
2440         curl_setopt( $ch, CURLOPT_POST, 1 );                    // save form using a POST
2441         curl_setopt( $ch, CURLOPT_POSTFIELDS, $params );        // load the POST variables
2442         curl_setopt( $ch, CURLOPT_URL, VALIDATOR_URL );         // set url to post to
2443         curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );           // return into a variable
2444
2445         $result = curl_exec ( $ch );
2446
2447         // if we encountered an error, then log it, and exit.
2448         if ( curl_error( $ch ) ) {
2449                 trigger_error( "Curl error #: " . curl_errno( $ch ) . " - " . curl_error ( $ch ) );
2450                 print "Curl error #: " . curl_errno( $ch ) . " - " . curl_error ( $ch ) . " - exiting.\n";
2451                 exit( 1 );
2452         }
2453
2454         curl_close ( $ch );
2455
2456         $valid = ( strpos( $result, "Failed validation" ) === false ? true : false );
2457
2458         return array( $valid, $result );
2459 }
2460
2461
2462 /**
2463  ** Get tidy to check for no HTML errors in the output file (e.g. unescaped strings).
2464  */
2465 function tidyCheckFile( $name ) {
2466         $file = DIRECTORY . "/" . $name;
2467         $command = PATH_TO_TIDY . " -output /tmp/out.html -quiet $file 2>&1";
2468         $x = `$command`;
2469
2470         // Look for the most interesting Tidy errors and warnings.
2471         if (   strpos( $x, "end of file while parsing attributes" ) !== false
2472                         || strpos( $x, "attribute with missing trailing quote mark" ) !== false
2473                         || strpos( $x, "missing '>' for end of tag" ) !== false
2474                         || strpos( $x, "Error:" ) !== false ) {
2475                 print "\nTidy found something - view details with: $command";
2476                 return false;
2477         } else {
2478                 return true;
2479         }
2480 }
2481
2482
2483 /**
2484  ** Returns whether or not an database error log file has changed in size since
2485  **        the last time this was run. This is used to tell if a test caused a DB error.
2486  */
2487 function dbErrorLogged() {
2488         static $filesize;
2489
2490         // first time running this function
2491         if ( !isset( $filesize ) ) {
2492                 // create log if it does not exist
2493                 if ( !file_exists( DB_ERROR_LOG_FILE ) ) {
2494                         saveFile( "", DB_ERROR_LOG_FILE );
2495                 }
2496                 $filesize = filesize( DB_ERROR_LOG_FILE );
2497                 return false;
2498         }
2499
2500         $newsize = filesize( DB_ERROR_LOG_FILE );
2501         // if the log has grown, then assume the current test caused it.
2502         if ( $newsize != $filesize ) {
2503                 $filesize = $newsize;
2504                 return true;
2505         }
2506
2507         return false;
2508 }
2509
2510 // //////////////// TOP-LEVEL PROBLEM-FINDING FUNCTION ////////////////////////
2511
2512 /**
2513  ** takes a page test, and runs it and tests it for problems in the output.
2514  **        Returns: False on finding a problem, or True on no problems being found.
2515  */
2516 function runWikiTest( pageTest $test, &$testname, $can_overwrite = false ) {
2517
2518         // by default don't overwrite a previous test of the same name.
2519         while ( ! $can_overwrite && file_exists( DIRECTORY . "/" . $testname . DATA_FILE ) ) {
2520                 $testname .= "-" . mt_rand( 0, 9 );
2521         }
2522
2523         $filename = DIRECTORY . "/" . $testname . DATA_FILE;
2524
2525         // Store the time before and after, to find slow pages.
2526         $before = microtime( true );
2527
2528         // Get MediaWiki to give us the output of this test.
2529         $wiki_preview = wikiTestOutput( $test );
2530
2531         $after = microtime( true );
2532
2533         // if we received no response, then that's interesting.
2534         if ( $wiki_preview == "" ) {
2535                 print "\nNo response received for: $filename";
2536                 return false;
2537         }
2538
2539         // save output HTML to file.
2540         $html_file = DIRECTORY . "/" . $testname . HTML_FILE;
2541         saveFile( $wiki_preview,  $html_file );
2542
2543         // if there were PHP errors in the output, then that's interesting too.
2544         if (       strpos( $wiki_preview, "<b>Warning</b>: "        ) !== false
2545                         || strpos( $wiki_preview, "<b>Fatal error</b>: "    ) !== false
2546                         || strpos( $wiki_preview, "<b>Notice</b>: "         ) !== false
2547                         || strpos( $wiki_preview, "<b>Error</b>: "          ) !== false
2548                         || strpos( $wiki_preview, "<b>Strict Standards:</b>" ) !== false
2549                         ) {
2550                 $error = substr( $wiki_preview, strpos( $wiki_preview, "</b>:" ) + 7, 50 );
2551                 // Avoid probable PHP bug with bad session ids; http://bugs.php.net/bug.php?id=38224
2552                 if ( $error != "Unknown: The session id contains illegal character" ) {
2553                         print "\nPHP error/warning/notice in HTML output: $html_file ; $error";
2554                         return false;
2555                 }
2556         }
2557
2558         // if there was a MediaWiki Backtrace message in the output, then that's also interesting.
2559         if ( strpos( $wiki_preview, "Backtrace:" ) !== false ) {
2560                 print "\nInternal MediaWiki error in HTML output: $html_file";
2561                 return false;
2562         }
2563
2564         // if there was a Parser error comment in the output, then that's potentially interesting.
2565         if ( strpos( $wiki_preview, "!-- ERR" ) !== false ) {
2566                 print "\nParser Error comment in HTML output: $html_file";
2567                 return false;
2568         }
2569
2570         // if a database error was logged, then that's definitely interesting.
2571         if ( dbErrorLogged() ) {
2572                 print "\nDatabase Error logged for: $filename";
2573                 return false;
2574         }
2575
2576         // validate result
2577         $valid = true;
2578         if ( VALIDATE_ON_WEB ) {
2579                 list ( $valid, $validator_output ) = validateHTML( $wiki_preview );
2580                 if ( !$valid ) print "\nW3C web validation failed - view details with: html2text " . DIRECTORY . "/" . $testname . ".validator_output.html";
2581         }
2582
2583         // Get tidy to check the page, unless we already know it produces non-XHTML output.
2584         if ( $test->tidyValidate() ) {
2585                 $valid = tidyCheckFile( $testname . HTML_FILE ) && $valid;
2586         }
2587
2588         // if it took more than 2 seconds to render, then it may be interesting too. (Possible DoS attack?)
2589         if ( ( $after - $before ) >= 2 ) {
2590                 print "\nParticularly slow to render (" . round( $after - $before, 2 ) . " seconds): $filename";
2591                 return false;
2592         }
2593
2594         if ( $valid ) {
2595                 // Remove temp HTML file if test was valid:
2596                 unlink( $html_file );
2597         } elseif ( VALIDATE_ON_WEB ) {
2598                 saveFile( $validator_output,   DIRECTORY . "/" . $testname . ".validator_output.html" );
2599         }
2600
2601         return $valid;
2602 }
2603
2604
2605 // ///////////////// RERUNNING OLD TESTS ///////////////////
2606
2607 /**
2608  ** We keep our failed tests so that they can be rerun.
2609  **        This function does that retesting.
2610  */
2611 function rerunPreviousTests() {
2612         print "Retesting previously found problems.\n";
2613
2614         $dir_contents = scandir ( DIRECTORY );
2615
2616         // sort file into the order a normal person would use.
2617         natsort ( $dir_contents );
2618
2619         foreach ( $dir_contents as $file ) {
2620
2621                 // if file is not a test, then skip it.
2622                 // Note we need to escape any periods or will be treated as "any character".
2623                 $matches = array();
2624                 if ( !preg_match( "/(.*)" . str_replace( ".", "\.", DATA_FILE ) . "$/", $file, $matches ) ) continue;
2625
2626                 // reload the test.
2627                 $full_path = DIRECTORY . "/" . $file;
2628                 $test = unserialize( file_get_contents( $full_path ) );
2629
2630                 // if this is not a valid test, then skip it.
2631                 if ( ! $test instanceof pageTest ) {
2632                         print "\nSkipping invalid test - $full_path";
2633                         continue;
2634                 }
2635
2636                 // The date format is in Apache log format, which makes it easier to locate
2637                 // which retest caused which error in the Apache logs (only happens usually if
2638                 // apache segfaults).
2639                 if ( !QUIET ) print "[" . date ( "D M d H:i:s Y" ) . "] Retesting $file (" . get_class( $test ) . ")";
2640
2641                 // run test
2642                 $testname = $matches[1];
2643                 $valid = runWikiTest( $test, $testname, true );
2644
2645                 if ( !$valid ) {
2646                         saveTest( $test, $testname );
2647                         if ( QUIET ) {
2648                                 print "\nTest: " . get_class( $test ) . " ; Testname: $testname\n------";
2649                         } else {
2650                                 print "\n";
2651                         }
2652                 }
2653                 else {
2654                         if ( !QUIET ) print "\r";
2655                         if ( DELETE_PASSED_RETESTS ) {
2656                                 $prefix = DIRECTORY . "/" . $testname;
2657                                 if ( is_file( $prefix . DATA_FILE ) ) unlink( $prefix . DATA_FILE );
2658                                 if ( is_file( $prefix . PHP_TEST ) ) unlink( $prefix . PHP_TEST );
2659                                 if ( is_file( $prefix . CURL_TEST ) ) unlink( $prefix . CURL_TEST );
2660                                 if ( is_file( $prefix . INFO_FILE ) ) unlink( $prefix . INFO_FILE );
2661                         }
2662                 }
2663         }
2664
2665         print "\nDone retesting.\n";
2666 }
2667
2668
2669 // ////////////////////  MAIN LOOP  ////////////////////////
2670
2671
2672 // first check whether CURL is installed, because sometimes it's not.
2673 if ( ! function_exists( 'curl_init' ) ) {
2674         die( "Could not find 'curl_init' function. Is the curl extension compiled into PHP?\n" );
2675 }
2676
2677 // Initialization of types. wikiFuzz doesn't have a constructor because we want to
2678 // access it staticly and not have any globals.
2679 wikiFuzz::$types = array_keys( wikiFuzz::$data );
2680
2681 // Make directory if doesn't exist
2682 if ( !is_dir( DIRECTORY ) ) {
2683         mkdir ( DIRECTORY, 0700 );
2684 }
2685 // otherwise, we first retest the things that we have found in previous runs
2686 else if ( RERUN_OLD_TESTS ) {
2687         rerunPreviousTests();
2688 }
2689
2690 // main loop.
2691 $start_time = date( "U" );
2692 $num_errors = 0;
2693 if ( !QUIET ) {
2694         print "Beginning main loop. Results are stored in the " . DIRECTORY . " directory.\n";
2695         print "Press CTRL+C to stop testing.\n";
2696 }
2697
2698 for ( $count = 0; true; $count++ ) {
2699         if ( !QUIET ) {
2700                 // spinning progress indicator.
2701                 switch( $count % 4 ) {
2702                         case '0': print "\r/";  break;
2703                         case '1': print "\r-";  break;
2704                         case '2': print "\r\\"; break;
2705                         case '3': print "\r|";  break;
2706                 }
2707                 print " $count";
2708         }
2709
2710         // generate a page test to run.
2711         $test = selectPageTest( $count );
2712
2713         $mins = ( date( "U" ) - $start_time ) / 60;
2714         if ( !QUIET && $mins > 0 ) {
2715                 print ".  $num_errors poss errors. "
2716                         . floor( $mins ) . " mins. "
2717                         . round ( $count / $mins, 0 ) . " tests/min. "
2718                         . get_class( $test ); // includes the current test name.
2719         }
2720
2721         // run this test against MediaWiki, and see if the output was valid.
2722         $testname = $count;
2723         $valid = runWikiTest( $test, $testname, false );
2724
2725         // save the failed test
2726         if ( ! $valid ) {
2727                 if ( QUIET ) {
2728                         print "\nTest: " . get_class( $test ) . " ; Testname: $testname\n------";
2729                 } else {
2730                         print "\n";
2731                 }
2732                 saveTest( $test, $testname );
2733                 $num_errors += 1;
2734         } else if ( KEEP_PASSED_TESTS ) {
2735                 // print current time, with microseconds (matches "strace" format), and the test name.
2736                 print " " . date( "H:i:s." ) . substr( current( explode( " ", microtime() ) ), 2 ) . " " . $testname;
2737                 saveTest( $test, $testname );
2738         }
2739
2740         // stop if we have reached max number of errors.
2741         if ( defined( "MAX_ERRORS" ) && $num_errors >= MAX_ERRORS ) {
2742                 break;
2743         }
2744
2745         // stop if we have reached max number of mins runtime.
2746         if ( defined( "MAX_RUNTIME" ) && $mins >= MAX_RUNTIME ) {
2747                 break;
2748         }
2749 }
2750
2751