T144845.patch
Bawolff (Brian Wolff)
Actions

Authored By

	Bawolff
	Sep 26 2016, 10:50 AM

Size

1 KB

Referenced Files

None

Subscribers

None

T144845.patch
View Options

	From c07ed8849d9b0e3513005646d5208439e49e52c8 Mon Sep 17 00:00:00 2001
	From: Brian Wolff <bawolff+wn@gmail.com>
	Date: Mon, 26 Sep 2016 10:40:30 +0000
	Subject: [PATCH] SECURITY: XSS in search if $wgAdvancedSearchHighlighting =
	true;

	In the non-default configuration where $wgAdvancedSearchHighlighting
	is set to true, there is an XSS vulnerability as HTML tags are
	not properly escaped if the tag spans multiple search results

	Issue introduced in abf726ea0 (MediaWiki 1.13 and above).

	Bug: T144845
	Change-Id: I2db7888d591b97f1a01bfd3b7567ce6f169874d3
	---
	includes/search/SearchHighlighter.php \| 8 ++++++++
	1 file changed, 8 insertions(+)

	diff --git a/includes/search/SearchHighlighter.php b/includes/search/SearchHighlighter.php
	index dd41a6e..79c401d 100644
	--- a/includes/search/SearchHighlighter.php
	+++ b/includes/search/SearchHighlighter.php
	@@ -29,6 +29,10 @@
	class SearchHighlighter {
	protected $mCleanWikitext = true;

	+ /**
	+ * @warning If you pass false to this constructor, then
	+ * the caller is responsible for HTML escaping.
	+ */
	function __construct( $cleanupWikitext = true ) {
	$this->mCleanWikitext = $cleanupWikitext;
	}
	@@ -456,6 +460,10 @@ class SearchHighlighter {
	$text = preg_replace( "/('''\|<\/?[iIuUbB]>)/", "", $text );
	$text = preg_replace( "/''/", "", $text );

	+ // Note, the previous /<\/?[^>]+>/ is insufficient
	+ // for XSS safety as the HTML tag can span multiple
	+ // search results (T144845).
	+ $text = Sanitizer::escapeHtmlAllowEntities( $text );
	return $text;
	}

	--
	1.9.5 (Apple Git-50.3)

Attached To	Mode
T140591: MediaWiki 1.28.1/1.27.2/1.23.16 security release	Attached	Detach File
T144845: XSS in SearchHighlighter::highlightText() [requires non-default config]	Attached	Detach File