Page MenuHomePhabricator
Files F66007771

T403289.updated.patch
mszwarc (Marcin Szwarc)
Actions

Authored By
mszwarc
Sep 11 2025, 9:00 AM
Size
1 KB
Referenced Files
None
Subscribers
None

T403289.updated.patch
View Options

From 22bab839ce50fac0387f0fb1aef48e338d64ae2a Mon Sep 17 00:00:00 2001
From: STran <stran@wikimedia.org>
Date: Mon, 1 Sep 2025 05:25:27 -0700
Subject: [PATCH] SECURITY: Escape XSS vector in UserInfoCard
What:
- Escape messages generated in CheckUserUserInfoCardService for groups
(local and global) before they're returned to the front-end
Bug: T403289
Change-Id: Iacd0287259cb250ea7c32fbfc1365b89b263e576
---
src/Services/CheckUserUserInfoCardService.php | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/Services/CheckUserUserInfoCardService.php b/src/Services/CheckUserUserInfoCardService.php
index 8aad2212..9fcb7fe0 100644
--- a/src/Services/CheckUserUserInfoCardService.php
+++ b/src/Services/CheckUserUserInfoCardService.php
@@ -139,14 +139,14 @@ class CheckUserUserInfoCardService {
$groupMessages = [];
foreach ( $groups as $group ) {
if ( $this->context->msg( "group-$group" )->exists() ) {
- $groupMessages[] = $this->context->msg( "group-$group" )->text();
+ $groupMessages[] = $this->context->msg( "group-$group" )->escaped();
}
}
$userInfo['groups'] = '';
if ( $groupMessages ) {
$userInfo['groups'] = $this->context->msg( 'checkuser-userinfocard-groups' )
->params( Message::listParam( $groupMessages, ListType::COMMA ) )
- ->text();
+ ->parse();
}
if ( !isset( $userInfo['totalEditCount'] ) ) {
@@ -168,14 +168,14 @@ class CheckUserUserInfoCardService {
foreach ( $globalGroups as $group ) {
if ( $this->context->msg( "group-$group" )->exists() ) {
$globalGroupMessages[] = $this->context->msg( "group-$group" )
- ->text();
+ ->escaped();
}
}
$userInfo['globalGroups'] = '';
if ( $globalGroupMessages ) {
$userInfo['globalGroups'] = $this->context->msg( 'checkuser-userinfocard-global-groups' )
->params( Message::listParam( $globalGroupMessages, ListType::COMMA ) )
- ->text();
+ ->parse();
}
if ( $centralAuthUser->isLocked() ) {
--
2.43.0

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
21793920
Default Alt Text
T403289.updated.patch (1 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits