Can now confirm that it is indeed the change mentioned in the description that introduced the issue. Changing the code modified in \Wikibase\Repo\Actions\ViewEntityAction::setDiffPageTitle to use \Message::rawParams instead of \Message::plaintextParams does fix the issues without introducing a XSS vulnerability:

But the styling looks wrong. Has it always been this way?

In T347578#9206634, @Michael wrote:

But the styling looks wrong. Has it always been this way?

I think so; this random Wikibase Cloud wiki diff looks the same.

See also T347522: Page difference title is not parsed any more.

Though it is not as simple as just changing plainTextParams -> rawParams, because that would still parse some HTML tags like <b> (see screenshot). But it should not be terribly harder, maybe we just need to do some extra escaping ourselves.

IIRC the recommended approach is that we do whatever escaping we need and then return that as a RawMessage.

I couldn't reproduce this at first, it turns out that Wikibase generates different page titles for diffs depending on the 'diffonly' option:

• https://www.wikidata.org/w/index.php?diff=1868940622&oldid=1868940600&title=Q56668748&diffonly=0
  
• https://www.wikidata.org/w/index.php?diff=1868940622&oldid=1868940600&title=Q56668748&diffonly=1
  

So… maybe the styling (which looked wrong to @Michael above :) ) isn't actually intended, just happening by accident when the page content is displayed below the diff?

In T347578#9207106, @Michael wrote:

Though it is not as simple as just changing plainTextParams -> rawParams, because that would still parse some HTML tags like <b> (see screenshot). But it should not be terribly harder, maybe we just need to do some extra escaping ourselves.

->plaintextParams( $titleText . $id ) should probably become ->rawParams( htmlspecialchars( $titleText ) . $id )

In T347578#9207898, @matmarex wrote:

So… maybe the styling (which looked wrong to @Michael above :) ) isn't actually intended, just happening by accident when the page content is displayed below the diff?

Given that it’s set in a method named setDiffPageTitle (see T347578#9206634), it’s obviously quite intended that it appears on diffs with diffonly=0. The accidental thing is that it doesn’t appear on diffs with diffonly=1 – if I understand the code correctly, the data it uses is set in an OutputPageParserOutput hook handler, which seems not to run with diffonly=1 (which sounds right on core’s side, why would the hook run if there’s no parsed content on the page?).

Also seeing this, ongoing issue? E.g., at https://www.wikidata.org/w/index.php?title=Q34623&curid=37349&diff=1985491049&oldid=1959113485 , https://www.wikidata.org/w/index.php?title=Q19599427&oldid=prev&diff=1984920937

Change 962646 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/Wikibase@master] Fix diff title escaping

https://gerrit.wikimedia.org/r/962646

Change 962646 merged by jenkins-bot:

[mediawiki/extensions/Wikibase@master] Fix diff title escaping

https://gerrit.wikimedia.org/r/962646

Change 962214 had a related patch set uploaded (by Bartosz Dziewoński; author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/Wikibase@wmf/1.41.0-wmf.28] Fix diff title escaping

https://gerrit.wikimedia.org/r/962214

Change 962214 merged by jenkins-bot:

[mediawiki/extensions/Wikibase@wmf/1.41.0-wmf.28] Fix diff title escaping

https://gerrit.wikimedia.org/r/962214

Mentioned in SAL (#wikimedia-operations) [2023-10-02T21:07:45Z] <kindrobot@deploy2002> Started scap: Backport for [[gerrit:962212|Ignore <!--comment--> only site notices (T347645)]], [[gerrit:962213|HookUtils: Fix checking page props (T347878)]], [[gerrit:962214|Fix diff title escaping (T347578)]], [[gerrit:962215|Diff: Add missing .mw-diff-inline-moved selector]]

Mentioned in SAL (#wikimedia-operations) [2023-10-02T21:08:59Z] <kindrobot@deploy2002> kindrobot and matmarex: Backport for [[gerrit:962212|Ignore <!--comment--> only site notices (T347645)]], [[gerrit:962213|HookUtils: Fix checking page props (T347878)]], [[gerrit:962214|Fix diff title escaping (T347578)]], [[gerrit:962215|Diff: Add missing .mw-diff-inline-moved selector]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-10-02T21:17:51Z] <kindrobot@deploy2002> Finished scap: Backport for [[gerrit:962212|Ignore <!--comment--> only site notices (T347645)]], [[gerrit:962213|HookUtils: Fix checking page props (T347878)]], [[gerrit:962214|Fix diff title escaping (T347578)]], [[gerrit:962215|Diff: Add missing .mw-diff-inline-moved selector]] (duration: 10m 06s)