Google Code-in

In MediaWiki core, maintenance/storage/checkStorage.php manually puts together SQL fragments to make IN queries. This is causing false positives in the phan-taint-check-plugin script.

Instead we should use the functionality of the $dbr->select() to generate them automatically.

Things like:

$res = $extDb->select( $blobsTable,
        [ 'blob_id' ],
        [ 'blob_id IN( ' . implode( ',', $blobIds ) . ')' ], __METHOD__ );

Should be replaced with

$res = $extDb->select(
       $blobsTable,
        [ 'blob_id' ],
        [ 'blob_id' => $blobids ],
        __METHOD__
);

You are expected to provide a patch in Wikimedia Gerrit which replaces all of manual IN construction in

• maintenance/storage/checkStorage.php (Line 209 and 413).

See https://www.mediawiki.org/wiki/Gerrit/Tutorial for how to set up Git and Gerrit.