• reduced reviewer anxiety by using $wgRequest instead of $_COOKIE?
  • fetched cookies using $wgRequest->getCookie(...)?
  • set cookies using $wgRequest->response()->setCookie(...)?

# <translate nowrap><!--T:32--> Attempt to fetch the UserID cookie value.</translate>
# <translate nowrap><!--T:33--> Note: the value returned isn't trusted and is forced to be an int.</translate>
$sId = intval( $wgRequest->getCookie( 'UserID' ) );

Avoid using functions like eval() and create_function(), as well as the /e pattern modifier for preg_replace(). While powerful and convenient, these features are inherently insecure:^[1][2]

• it's easier to put arbitrary strings into text processed by regular expressions, which – when combined with the /e pattern modifier – can lead to code injection attacks.
• it is harder to read and maintain code that is part of a string.
• static analysis tools won't catch warnings and errors in the code.
• opcode caches (like APC) can't cache code mixed into strings.
• create_function() sometimes has garbage-collection issues.
• A loop which has a create_function() inside will create a new function on each iteration.

Sometimes you really do need these features (obviously eval.php needs to run eval();) but in most cases, we'd rather see the function broken out and referred as a callback.

Inline lambda functions will make it easier to make your callback inline while retaining the benefits of code that's written in native syntax instead of strings.

• Anything external that is used in part of regex should be escaped with preg_quote ($externalStr, $delimiter). It puts a backslash in front of every character that is part of the regular expression syntax, and escapes also the delimiter given as second parameter:

$str = preg_replace( "!" . preg_quote( $externalStr, '!' ) . "!", $replacement, $str );

• executed the program via Shell::command() from namespace MediaWiki\Shell?
• quoted all arguments to external programs using the above's secure parameter passing facilities (which is basically everything except for unsafeParams())?

// <translate nowrap><!--T:44--> Automatically escape any naughty characters</translate>
$result = Shell::command( $cmd, '--version' )
    ->params( 'some', 'extra', 'parameters' )
    ->execute();

Note that old wfShellExec()/wfEscapeShellArg() are not recommended because they make it easier for developers to miss escaping a parameter.

• used User ::getEditToken() to implement anti-CSRF measures?
• used User::matchEditToken() when checking the token to avoid timing attacks?
• reduced reviewer anxiety by using or extending MediaWiki's existing form functionality?

• reduced reviewer anxiety by using $wgRequest instead of $_GET?

# <translate nowrap><!--T:50--> Check if the action parameter is set to '<tvar name=1>purge</tvar>'</translate>
if ( $wgRequest->getVal( 'action' ) == 'purge' ) {
    ...

• used the Html and Xml helper classes?

# <translate nowrap><!--T:52--> <tvar name=1>rawElement()</tvar> escapes all attribute values</translate>
# <translate nowrap><!--T:53--> (which, in this case, is provided by <tvar name=1>$myClass</tvar>)</translate>
echo Html::rawElement( 'p', [ 'class' => $myClass  ] );

• reduced reviewer anxiety by using ResourceLoader to deliver CSS and JavaScript resources?

• Use the Sanitizer::checkCss method for any css received from a user, possibly along with the Html class.

# <translate nowrap><!--T:57--> let <tvar name=1>$CSSFromUser</tvar> be the user's CSS.</translate>
echo Html::rawElement( 'p', [ 'style' => Sanitizer::checkCss( $CSSFromUser ) ] );

• For CSS provided by the extension (and not the user), this is not needed (and will remove some valid things like background-image:). However, extension provided CSS should go in stylesheets loaded by ResourceLoader, and not in style attributes.

• reduced reviewer anxiety by using $wgRequest instead of $_POST
• Always validate that any POST data received is what you expect it to be

# <translate nowrap><!--T:61--> Check if the action parameter is set to '<tvar name=1>render</tvar>'</translate>
if ( $wgRequest->getVal( 'action' ) == 'render' ) {
    ...

• See #GET data above

• Clearly added comments to explain unexpected or odd parts of your code?

# <translate nowrap><!--T:63--> $wgRequest isn't yet available.</translate> <translate nowrap><!--T:64--> Forced to use <tvar name=1>$_GET</tvar> instead.</translate>
if ( $_GET['setupTestSuite'] !== null ) {
 	$setupTestSuiteName = $_GET['setupTestSuite'];
 	...

• used MediaWiki's database wrappers?