T133507-REL1_23.patch
No One
Actions

Authored By

	Bawolff
	May 9 2016, 8:00 AM

Size

4 KB

Referenced Files

None

Subscribers

None

T133507-REL1_23.patch
View Options

	From 17b1e636eae6a625ba22dadf2ff4a7b610689456 Mon Sep 17 00:00:00 2001
	From: Brian Wolff <bawolff+wn@gmail.com>
	Date: Mon, 25 Apr 2016 14:08:46 -0400
	Subject: [PATCH] [SECURITY] Add rel="noreferrer noopener" when target
	attribute would open window

	noreferrer is used as support for noopener is very limited.
	This is to prevent the attack detailed at
	https://mathiasbynens.github.io/rel-noopener/ where you can
	navigate the parent window, even if the new window is a cross-origin.

	Bug: T133507
	Change-Id: I6e4ab938861e246ff44048077b94847e303f1859
	---
	includes/DefaultSettings.php \| 8 +++++++-
	includes/Linker.php \| 11 ++++++++++-
	includes/parser/Parser.php \| 19 +++++++++++++++----
	tests/parser/parserTests.txt \| 4 ++--
	4 files changed, 34 insertions(+), 8 deletions(-)

	diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
	index d874e64..7ccda3f 100644
	--- a/includes/DefaultSettings.php
	+++ b/includes/DefaultSettings.php
	@@ -3887,7 +3887,13 @@ $wgDebugTidy = false;
	$wgRawHtml = false;

	/**
	- * Set a default target for external links, e.g. _blank to pop up a new window
	+ * Set a default target for external links, e.g. _blank to pop up a new window.
	+ *
	+ * This will also set the "noreferrer" and "noopener" link rel to prevent the
	+ * attack described at https://mathiasbynens.github.io/rel-noopener/ .
	+ * Some older browsers may not support these link attributes, hence
	+ * setting $wgExternalLinkTarget to _blank may represent a security risk
	+ * to some of your users.
	*/
	$wgExternalLinkTarget = false;

	diff --git a/includes/Linker.php b/includes/Linker.php
	index 534ad4d..d9e8b6d 100644
	--- a/includes/Linker.php
	+++ b/includes/Linker.php
	@@ -1049,7 +1049,16 @@ class Linker {
	if ( !$title ) {
	$title = $wgTitle;
	}
	- $attribs['rel'] = Parser::getExternalLinkRel( $url, $title );
	+ $newRel = Parser::getExternalLinkRel( $url, $title );
	+ if ( !isset( $attribs['rel'] ) \|\| $attribs['rel'] === '' ) {
	+ $attribs['rel'] = $newRel;
	+ } elseif( $newRel !== '' ) {
	+ // Merge the rel attributes.
	+ $newRels = explode( ' ', $newRel );
	+ $oldRels = explode( ' ', $attribs['rel'] );
	+ $combined = array_unique( array_merge( $newRels, $oldRels ) );
	+ $attribs['rel'] = implode( ' ', $combined );
	+ }
	$link = '';
	$success = wfRunHooks( 'LinkerMakeExternalLink',
	array( &$url, &$text, &$link, &$attribs, $linktype ) );
	diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
	index 2d9078d..2d313d0 100644
	--- a/includes/parser/Parser.php
	+++ b/includes/parser/Parser.php
	@@ -1721,11 +1721,22 @@ class Parser {
	*/
	function getExternalLinkAttribs( $url = false ) {
	$attribs = array();
	- $attribs['rel'] = self::getExternalLinkRel( $url, $this->mTitle );
	-
	- if ( $this->mOptions->getExternalLinkTarget() ) {
	- $attribs['target'] = $this->mOptions->getExternalLinkTarget();
	+ $rel = self::getExternalLinkRel( $url, $this->mTitle );
	+
	+ $target = $this->mOptions->getExternalLinkTarget();
	+ if ( $target ) {
	+ $attribs['target'] = $target;
	+ if ( !in_array( $target, array( '_self', '_parent', '_top' ) ) ) {
	+ // T133507. New windows can navigate parent cross-origin.
	+ // Including noreferrer due to lacking browser
	+ // support of noopener. Eventually noreferrer should be removed.
	+ if ( $rel !== '' ) {
	+ $rel .= ' ';
	+ }
	+ $rel .= 'noreferrer noopener';
	+ }
	}
	+ $attribs['rel'] = $rel;
	return $attribs;
	}

	diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
	index c3e972e..ca9cb7b 100644
	--- a/tests/parser/parserTests.txt
	+++ b/tests/parser/parserTests.txt
	@@ -9969,7 +9969,7 @@ Image with link parameter, wgExternalLinkTarget
	!! config
	wgExternalLinkTarget='foobar'
	!! html
	-<p><a href="http://example.com/" target="foobar" rel="nofollow"><img alt="Foobar.jpg" src="http://example.com/images/3/3a/Foobar.jpg" width="1941" height="220" /></a>
	+<p><a href="http://example.com/" target="foobar" rel="nofollow noreferrer noopener"><img alt="Foobar.jpg" src="http://example.com/images/3/3a/Foobar.jpg" width="1941" height="220" /></a>
	</p>
	!! end

	@@ -10002,7 +10002,7 @@ Image with link parameter, wgExternalLinkTarget, unnamed parameter
	!! config
	wgExternalLinkTarget='foobar'
	!! html
	-<p><a href="http://example.com/" title="Title" target="foobar" rel="nofollow"><img alt="Title" src="http://example.com/images/3/3a/Foobar.jpg" width="1941" height="220" /></a>
	+<p><a href="http://example.com/" title="Title" target="foobar" rel="nofollow noreferrer noopener"><img alt="Title" src="http://example.com/images/3/3a/Foobar.jpg" width="1941" height="220" /></a>
	</p>
	!! end

	--
	2.0.1

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3711121
Default Alt Text: T133507-REL1_23.patch (4 KB)

Attached To	Mode
T124940: MediaWiki 1.26.3 security release	Attached	Detach File
T133507: Careless use of $wgExternalLinkTarget is insecure	Attached	Detach File

T133507-REL1_23.patchNo OneActions

T133507-REL1_23.patchView Options

File Metadata

Event Timeline

T133507-REL1_23.patch
No One
Actions

T133507-REL1_23.patch
View Options