T158689-master.patch
Reedy (Sam Reed)
Actions

Authored By

	Reedy
	Feb 21 2017, 7:25 PM

Size

926 B

Referenced Files

None

Subscribers

None

T158689-master.patch
View Options

	From 57d9556eeadf227946300145f08e225cb34a21cd Mon Sep 17 00:00:00 2001
	From: Reedy <reedy@wikimedia.org>
	Date: Tue, 21 Feb 2017 19:20:16 +0000
	Subject: [PATCH] SECURITY: Escape start argument before passing to pygments

	Issue identified by Yorick Koster

	Bug: T158689
	Change-Id: Ib55f7a38edbdd39c9587794d250e22d3b26950be
	---
	SyntaxHighlight_GeSHi.class.php \| 4 ++--
	1 file changed, 2 insertions(+), 2 deletions(-)

	diff --git a/SyntaxHighlight_GeSHi.class.php b/SyntaxHighlight_GeSHi.class.php
	index 46567e8..2338d45 100644
	--- a/SyntaxHighlight_GeSHi.class.php
	+++ b/SyntaxHighlight_GeSHi.class.php
	@@ -263,8 +263,8 @@ class SyntaxHighlight_GeSHi {
	}

	// Starting line number
	- if ( isset( $args['start'] ) ) {
	- $options['linenostart'] = $args['start'];
	+ if ( isset( $args['start'] ) && ctype_digit( $args['start'] ) ) {
	+ $options['linenostart'] = (int)$args['start'];
	}

	if ( $inline ) {
	--
	2.9.3

Attached To	Mode
T140591: MediaWiki 1.28.1/1.27.2/1.23.16 security release	Attached	Detach File
T158689: Parameters injection in SyntaxHighlight results in multiple vulnerabilities	Attached	Detach File