Change Details

**Author:** `incarus6` **Description:** The fact that u can use the "position" parameter (http://de.selfhtml.org/css/eigenschaften/positionierung.htm#position) in Wikipedia is a security risk, because you can use it on your user page to overlay buttons with blank images, or links, or make the whole page unusable. Steps to reproduce Use the following code on an user page: <div style="position:absolute; top:-118px; left:-170px; z-index:2;"> [[File:Inverted Wikipedia logo.png |115px|link=|alt=|verweis=Wikipedia:Hauptseite]] </div> -------------------------- **Version**: unspecified **Severity**: major

The `position` CSS attribute is allowed in wikitext and TemplateStyles CSS; it can be used to position parts of the user-generated content in places which are normally software-generated, e.g. on top of the sidebar menu or the search box. (Depending on the skin, `z-index` might or might not be also needed to achieve this.) A similar effect can be achieved with negative margins as well. This is occasionally used for vandalism, e.g. [[https://hu.wikipedia.org/w/index.php?title=Wikip%C3%A9dia:Adminisztr%C3%A1torok_%C3%BCzen%C5%91fala&diff=19674665&oldid=19670961|flipping the contents of the page]] or [[https://en.wikipedia.org/w/index.php?title=Module:Dynkin&diff=prev&oldid=669919700|obscuring everything using absolute or fixed positioning]]. This is confusing for patrollers as it also affects difflinks, but still relatively easy to revert using the undo/rollback links in recent changes / page history / etc. In theory it could also be used for more dangerous things, by overlaying transparent links on top of clickable areas of the interface area it's possible to hijack clicks. [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5392|CVE-2012-5392]] has been reserved for this. On the other hand, positioning is a fundamental part of anything with a nontrivial amount of formatting, and is regularly used in infoboxes, amboxes and similar templates. Even the ability to break out of the content area is (ab)used for displaying various indicators on top of the page (such as a featured star, or the coordinates of the article subject). [[https://www.mediawiki.org/wiki/Help:Page_status_indicators|Page status indicators]] have been provided as a replacement for this, but the old method is still being used, so fixing this issue is blocked on finishing that migration. (See T135802#2332298 for some problems communities have with using indicators.) They are also used decoratively on user pages (e.g. to modify the site logo); breaking that probably would not be the end of the world. Some potential solutions that were dicussed in the comments: * Make the content are a stacking context (done in df10f03a7a28) and make sure everything else has a higher z-index (and non-transparent background, although positioning content behind a transparent interface block is harder to abuse). This would have to be done for every skin. * Make the content area `overflow: hidden` (and either ban `position: fixed`, or make the content area a 3D rendering context). See T40848#1913661 for more details. * Use [[https://caniuse.com/#feat=css-containment|CSS containment]]. Not widely supported yet though. Per T40848#1938655 the plan is to use `overflow: hidden`, first on a larger area so it's still possible to overlay the interface area where status indicators are, then on the content area once status indicator migration is finished. Status indicator blocks themselves would have to be secured (T135802).

**Author:** `incarus6`The `position` CSS attribute is allowed in wikitext and TemplateStyles CSS; it can be used to position parts of the user-generated content in places which are normally software-generated, e.g. on top of the sidebar menu or the search box. (Depending on the skin, `z-index` might or might not be also needed to achieve this.) A similar effect can be achieved with negative margins as well. **Description:**This is occasionally used for vandalism, e.g. [[https://hu.wikipedia.org/w/index.php?title=Wikip%C3%A9dia:Adminisztr%C3%A1torok_%C3%BCzen%C5%91fala&diff=19674665&oldid=19670961|flipping the contents of the page]] or [[https://en.wikipedia.org/w/index.php?title=Module:Dynkin&diff=prev&oldid=669919700|obscuring everything using absolute or fixed positioning]]. This is confusing for patrollers as it also affects difflinks, but still relatively easy to revert using the undo/rollback links in recent changes / page history / etc. The fact that u can use the "position" parameter (http://de.selfhtml.org/css/eigenschaften/positionierung.htm#position) in Wikipedia is a security risk, because you can use it on your user page to overlay buttons with blank images, or linkIn theory it could also be used for more dangerous things, or make the whole page unusable. Stepsby overlaying transparent links on top of clickable areas of the interface area it's possible to reproducehijack clicks. Use the following code on an user page:[[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5392|CVE-2012-5392]] has been reserved for this. <div style="position:absolute;On the other hand, positioning is a fundamental part of anything with a nontrivial amount of formatting, and is regularly used in infoboxes, amboxes and similar templates. Even the ability to break out of the content area is (ab)used for displaying various indicators on top of the page (such as a featured star, or the coordinates of the article subject). [[https://www.mediawiki.org/wiki/Help:Page_status_indicators|Page status indicators]] have been provided as a replacement for this, but the old method is still being used, top:-118px;so fixing this issue is blocked on finishing that migration. left:-170px; z-index:2;"> [[File:Inverted Wikipedia logo.png |115px|link=|alt=|verweis=Wikipedia:Hauptseite]] </div>(See T135802#2332298 for some problems communities have with using indicators.) They are also used decoratively on user pages (e.g. to modify the site logo); breaking that probably would not be the end of the world. --------------------------Some potential solutions that were dicussed in the comments: * Make the content are a stacking context (done in df10f03a7a28) and make sure everything else has a higher z-index (and non-transparent background, although positioning content behind a transparent interface block is harder to abuse). This would have to be done for every skin. **Version**: unspecified Make the content area `overflow: hidden` (and either ban `position: fixed`, or make the content area a 3D rendering context). See T40848#1913661 for more details. **Severity**: major Use [[https://caniuse.com/#feat=css-containment|CSS containment]]. Not widely supported yet though. Per T40848#1938655 the plan is to use `overflow: hidden`, first on a larger area so it's still possible to overlay the interface area where status indicators are, then on the content area once status indicator migration is finished. Status indicator blocks themselves would have to be secured (T135802).