0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patch
Jackmcbarn (Jackmcbarn)
Actions

Authored By

	Jackmcbarn
	Dec 22 2014, 5:43 PM

Size

2 KB

Referenced Files

None

Subscribers

None

0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patch
View Options

	From 277118e53f3617ca02ac663afbafcba822b5ebce Mon Sep 17 00:00:00 2001
	From: Jackmcbarn <jackmcbarn@gmail.com>
	Date: Mon, 22 Dec 2014 12:42:37 -0500
	Subject: [PATCH] SECURITY: Sanitize the content of Lua backtraces

	Bug: T85113
	Change-Id: Iede661a34f4ec2f384bd0407e2fb8f271ff54a77
	---
	engines/LuaCommon/LuaCommon.php \| 18 ++++++++++--------
	1 files changed, 10 insertions(+), 8 deletions(-)

	diff --git a/engines/LuaCommon/LuaCommon.php b/engines/LuaCommon/LuaCommon.php
	index f8a6e2e..9f77234 100644
	--- a/engines/LuaCommon/LuaCommon.php
	+++ b/engines/LuaCommon/LuaCommon.php
	@@ -936,25 +936,27 @@ class Scribunto_LuaError extends ScribuntoException {
	}

	if ( strval( $info['namewhat'] ) !== '' ) {
	- $function = wfMessage( 'scribunto-lua-in-function', $info['name'] );
	+ $function = wfMessage( 'scribunto-lua-in-function', wfEscapeWikiText( $info['name'] ) );
	in_array( 'content', $msgOptions ) ?
	- $function = $function->inContentLanguage()->text() :
	- $function = $function->text();
	+ $function = $function->inContentLanguage()->plain() :
	+ $function = $function->plain();
	} elseif ( $info['what'] == 'main' ) {
	$function = wfMessage( 'scribunto-lua-in-main' );
	in_array( 'content', $msgOptions ) ?
	- $function = $function->inContentLanguage()->text() :
	- $function = $function->text();
	+ $function = $function->inContentLanguage()->plain() :
	+ $function = $function->plain();
	} else {
	// C function, tail call, or a Lua function where Lua can't
	// guess the name
	$function = '?';
	}

	- $backtraceLine = wfMessage( 'scribunto-lua-backtrace-line', "<strong>$src</strong>", $function );
	+ $backtraceLine = wfMessage( 'scribunto-lua-backtrace-line' )
	+ ->rawParams( "<strong>$src</strong>" )
	+ ->params( $function );
	in_array( 'content', $msgOptions ) ?
	- $backtraceLine = $backtraceLine->inContentLanguage()->text() :
	- $backtraceLine = $backtraceLine->text();
	+ $backtraceLine = $backtraceLine->inContentLanguage()->parse() :
	+ $backtraceLine = $backtraceLine->parse();

	$s .= "<li>\n\t" . $backtraceLine . "\n</li>\n";
	}
	--
	1.7.9

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 22462
Default Alt Text: 0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patch (2 KB)

0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patchJackmcbarn (Jackmcbarn)Actions

0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patchView Options

File Metadata

Event Timeline

0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patch
Jackmcbarn (Jackmcbarn)
Actions

0001-SECURITY-Sanitize-the-content-of-Lua-backtraces.patch
View Options