Page MenuHomePhabricator
Files F41659453

T347708-3.patch
Dreamy_Jazz (WBrown (WMF))
Actions

Authored By
Dreamy_Jazz
Jan 8 2024, 7:55 PM
Size
5 KB
Referenced Files
None
Subscribers
None

T347708-3.patch
View Options

From 82318ce1c7ed8bb1d53580dcff30df571fd7763b Mon Sep 17 00:00:00 2001
From: Dreamy Jazz <wpgbrown@wikimedia.org>
Date: Mon, 8 Jan 2024 19:48:41 +0000
Subject: [PATCH] [PATCH] SECURITY: Address many XSS vectors via message
definitions
Why:
* Several messages in the CheckUser extension allow users without
editsitecss or editsitejs to add CSS and/or JS code that is
viewable by users using the CheckUser interfaces.
* These interfaces should not allow CSS and/or JS code to be
injected in this way and should properly escape HTML unless
the use of HTML code is required.
What:
* Update the code in Special:CheckUserLog to pass the parameters
as raw parameters and also use ::parse to remove dangerous
HTML but allow the use of bdi elements.
* Update SpecialCheckUserLog to always escape the 'parentheses'
message.
* Update CheckUserGetUsersPager to escape the
'checkuser-massblock-text' message.
* Change ApiQueryCheckUser to escape the 'checkuser-reason-api'
message.
* Update SpecialInvestigate to escape the Language::userDate
output.
Bug: T347708
Change-Id: If3ce02cac9c5f2a6f84c42d902b8290eb1fa7250
---
src/Api/ApiQueryCheckUser.php | 2 +-
.../Pagers/CheckUserGetUsersPager.php | 2 +-
src/CheckUser/Pagers/CheckUserLogPager.php | 40 +++++++++----------
src/Investigate/Pagers/TimelinePager.php | 4 +-
4 files changed, 24 insertions(+), 24 deletions(-)
diff --git a/src/Api/ApiQueryCheckUser.php b/src/Api/ApiQueryCheckUser.php
index 8943a59e..37b5c8fb 100644
--- a/src/Api/ApiQueryCheckUser.php
+++ b/src/Api/ApiQueryCheckUser.php
@@ -75,7 +75,7 @@ class ApiQueryCheckUser extends ApiQueryBase {
$this->dieWithError( 'apierror-checkuser-missingsummary', 'missingdata' );
}
- $reason = $this->msg( 'checkuser-reason-api', $reason )->inContentLanguage()->text();
+ $reason = $this->msg( 'checkuser-reason-api', $reason )->inContentLanguage()->escaped();
// absolute time
$timeCutoff = strtotime( $timecond );
if ( !$timeCutoff || $timeCutoff < 0 || $timeCutoff > time() ) {
diff --git a/src/CheckUser/Pagers/CheckUserGetUsersPager.php b/src/CheckUser/Pagers/CheckUserGetUsersPager.php
index 52b473a5..0c9a75ec 100644
--- a/src/CheckUser/Pagers/CheckUserGetUsersPager.php
+++ b/src/CheckUser/Pagers/CheckUserGetUsersPager.php
@@ -656,7 +656,7 @@ class CheckUserGetUsersPager extends AbstractCheckUserPager {
->setSubmitTextMsg( 'checkuser-massblock-commit' )
->setSubmitId( 'checkuserblocksubmit' )
->setSubmitName( 'checkuserblock' )
- ->setHeaderHtml( $this->msg( 'checkuser-massblock-text' )->text() );
+ ->setHeaderHtml( $this->msg( 'checkuser-massblock-text' )->escaped() );
if ( $config->get( 'BlockAllowsUTEdit' ) ) {
$fieldset->addFields( [
diff --git a/src/CheckUser/Pagers/CheckUserLogPager.php b/src/CheckUser/Pagers/CheckUserLogPager.php
index c08a2d75..10901136 100644
--- a/src/CheckUser/Pagers/CheckUserLogPager.php
+++ b/src/CheckUser/Pagers/CheckUserLogPager.php
@@ -154,14 +154,14 @@ class CheckUserLogPager extends RangeChronologicalPager {
}
$user .= $this->msg( 'word-separator' )->escaped()
. Html::rawElement( 'span', [ 'classes' => 'mw-usertoollinks' ],
- $this->msg( 'parentheses' )->params( $this->getLinkRenderer()->makeLink(
+ $this->msg( 'parentheses' )->rawParams( $this->getLinkRenderer()->makeLink(
SpecialPage::getTitleFor( 'CheckUserLog' ),
$this->msg( 'checkuser-log-checks-by' )->text(),
[],
[
'cuInitiator' => $row->actor_name,
]
- ) )->text()
+ ) )->escaped()
);
}
@@ -201,25 +201,25 @@ class CheckUserLogPager extends RangeChronologicalPager {
'ipedits-xff' => 'ipactions-xff',
'useredits' => 'useractions'
][$row->cul_type] ?? $row->cul_type;
- $rowContent = $this->msg(
- 'checkuser-log-entry-' . $cul_type,
- $user,
- $target,
- $this->generateTimestampLink(
- $lang->userTimeAndDate(
- wfTimestamp( TS_MW, $row->cul_timestamp ), $contextUser
+ $rowContent = $this->msg( 'checkuser-log-entry-' . $cul_type )
+ ->rawParams(
+ $user,
+ $target,
+ $this->generateTimestampLink(
+ $lang->userTimeAndDate(
+ wfTimestamp( TS_MW, $row->cul_timestamp ), $contextUser
+ ),
+ $row
),
- $row
- ),
- $this->generateTimestampLink(
- $lang->userDate( wfTimestamp( TS_MW, $row->cul_timestamp ), $contextUser ),
- $row
- ),
- $this->generateTimestampLink(
- $lang->userTime( wfTimestamp( TS_MW, $row->cul_timestamp ), $contextUser ),
- $row
- )
- )->text();
+ $this->generateTimestampLink(
+ $lang->userDate( wfTimestamp( TS_MW, $row->cul_timestamp ), $contextUser ),
+ $row
+ ),
+ $this->generateTimestampLink(
+ $lang->userTime( wfTimestamp( TS_MW, $row->cul_timestamp ), $contextUser ),
+ $row
+ )
+ )->parse();
$rowContent .= $this->commentFormatter->formatBlock(
$this->commentStore->getComment( 'cul_reason', $row )->text
);
diff --git a/src/Investigate/Pagers/TimelinePager.php b/src/Investigate/Pagers/TimelinePager.php
index e6a7b70e..579696f1 100644
--- a/src/Investigate/Pagers/TimelinePager.php
+++ b/src/Investigate/Pagers/TimelinePager.php
@@ -109,14 +109,14 @@ class TimelinePager extends ReverseChronologicalPager {
$dateHeader = $this->getLanguage()->userDate( wfTimestamp( TS_MW, $row->cuc_timestamp ), $this->getUser() );
if ( $this->lastDateHeader === null ) {
$this->lastDateHeader = $dateHeader;
- $line .= Html::rawElement( 'h4', [], $dateHeader );
+ $line .= Html::element( 'h4', [], $dateHeader );
$line .= Html::openElement( 'ul' );
} elseif ( $this->lastDateHeader !== $dateHeader ) {
$this->lastDateHeader = $dateHeader;
// Start a new list with a new date header
$line .= Html::closeElement( 'ul' );
- $line .= Html::rawElement( 'h4', [], $dateHeader );
+ $line .= Html::element( 'h4', [], $dateHeader );
$line .= Html::openElement( 'ul' );
}
--
2.25.1

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
14458010
Default Alt Text
T347708-3.patch (5 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits