Maniphest T178723

OngletGoogle gadget looks suspicious
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	MaxSem
	Oct 20 2017, 10:10 PM

Tags

Referenced Files

None

Subscribers

Description

The ocwiki and wowiki versions of this gadget assemble HTML by hand, using page title without fully escaping it. Neither of these gadgets are currently usable: on oc:, the gadget isn't enabled while on wo: it's disabled because it's not migrated to ResourceLoader. Therefore, while it's not currently exploitable, it should still be fixed.

Event Timeline

MaxSem created this task.Oct 20 2017, 10:10 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 20 2017, 10:10 PM

MaxSem added projects: MediaWiki-extensions-Gadgets, Vuln-XSS.Oct 20 2017, 10:10 PM

• dpatrick triaged this task as High priority.Oct 25 2017, 5:12 PM

I recopied the gadget from frwiki, where it doesn't appear exploitable

mwgrep didn't see any other instances.

Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".Oct 25 2017, 5:25 PM

He7d3r edited projects, added JavaScript; removed MediaWiki-extensions-Gadgets.Oct 28 2017, 2:58 PM

He7d3r added a project: WMF-General-or-Unknown.Oct 28 2017, 3:00 PM

• chasemp added a project: Security.Feb 10 2020, 10:55 PM

• chasemp removed a project: acl*security.Feb 20 2020, 8:15 PM