Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F65711237
T401099-parsoid-minimal.patch
cscott (C. Scott Ananian)
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Authored By
cscott
Aug 4 2025, 3:01 PM
2025-08-04 15:01:55 (UTC+0)
Size
750 B
Referenced Files
None
Subscribers
None
T401099-parsoid-minimal.patch
View Options
diff --git a/src/Core/Sanitizer.php b/src/Core/Sanitizer.php
index 086ac1ea9..1b823d36c 100644
--- a/src/Core/Sanitizer.php
+++ b/src/Core/Sanitizer.php
@@ -965,7 +965,10 @@ class Sanitizer {
# * Disallow data attributes used by MediaWiki code
# * Ensure that the attribute is not namespaced by banning
# colons.
- if ( ( !preg_match( '/^data-[^:]*$/iD', $k ) && !isset( $list[$k] ) )
+ # * Ensure attribute name will be accepted by the HTML
+ # parser; see
+ # https://github.com/whatwg/dom/issues/849#issuecomment-1007541209
+ if ( ( !preg_match( '|^data-[^:= \t\r\n/>\0]*$|iD', $k ) && !isset( $list[$k] ) )
|| self::isReservedDataAttribute( $k )
) {
$newAttrs[$k] = [ null, $origV, $origK ];
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
21631575
Default Alt Text
T401099-parsoid-minimal.patch (750 B)
Attached To
Mode
T401099: CVE-2025-61638: Sanitizer::validateAttributes data-XSS
Attached
Detach File
Event Timeline
Log In to Comment