T73394-escape_gt-wmf21.patch
csteipp (Chris Steipp)
Actions

Authored By

	• csteipp
	Mar 17 2015, 10:40 PM

Size

4 KB

Referenced Files

None

Subscribers

None

T73394-escape_gt-wmf21.patch
View Options

	From c0453dd391c570eb1a52eeaa817b9979f2618297 Mon Sep 17 00:00:00 2001
	From: csteipp <csteipp@wikimedia.org>
	Date: Tue, 17 Mar 2015 15:20:56 -0700
	Subject: [PATCH] SECURITY: Escape > in Html::expandAttributes

	Escape > characters in attributes, so we don't confuse post-processing,
	like LanguageConverter.

	Bug: T73394
	Change-Id: I8d74e6a0e873cc54dec9557e2d8f7409e65f425f
	---
	includes/Html.php \| 7 +++++--
	tests/parser/parserTests.txt \| 4 ++--
	2 files changed, 7 insertions(+), 4 deletions(-)

	diff --git a/includes/Html.php b/includes/Html.php
	index 8799225..f429fb2 100644
	--- a/includes/Html.php
	+++ b/includes/Html.php
	@@ -603,17 +603,20 @@ class Html {
	} else {
	// Apparently we need to entity-encode \n, \r, \t, although the
	// spec doesn't mention that. Since we're doing strtr() anyway,
	- // and we don't need <> escaped here, we may as well not call
	- // htmlspecialchars().
	+ // we may as well not call htmlspecialchars().
	// @todo FIXME: Verify that we actually need to
	// escape \n\r\t here, and explain why, exactly.
	#
	// We could call Sanitizer::encodeAttribute() for this, but we
	// don't because we're stubborn and like our marginal savings on
	// byte size from not having to encode unnecessary quotes.
	+ // The only difference between this transform and the one by
	+ // Sanitizer::encodeAttribute() is '<' is only encoded here if
	+ // $wgWellFormedXml is set, and ' is not encoded.
	$map = array(
	'&' => '&',
	'"' => '"',
	+ '>' => '>',
	"\n" => ' ',
	"\r" => ' ',
	"\t" => ' '
	diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
	index 966b666..d6b085d 100644
	--- a/tests/parser/parserTests.txt
	+++ b/tests/parser/parserTests.txt
	@@ -13669,7 +13669,7 @@ section 5
	</ul>
	</div>

	-<h2><a href="#text_.3E_text" class="mw-headline-anchor" aria-hidden="true" title="Link to this section">§</a><span class="mw-headline" id="text_.3E_text">text > text</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&action=edit&section=1" title="Edit section: text > text">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
	+<h2><a href="#text_.3E_text" class="mw-headline-anchor" aria-hidden="true" title="Link to this section">§</a><span class="mw-headline" id="text_.3E_text">text > text</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&action=edit&section=1" title="Edit section: text > text">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
	<p>section 1
	</p>
	<h2><a href="#text_.3C_text" class="mw-headline-anchor" aria-hidden="true" title="Link to this section">§</a><span class="mw-headline" id="text_.3C_text">text < text</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&action=edit&section=2" title="Edit section: text < text">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
	@@ -19294,7 +19294,7 @@ __TOC__
	</div>

	<h2><a href="#Hello" class="mw-headline-anchor" aria-hidden="true" title="Link to this section">§</a><span class="mw-headline" id="Hello"><sup class="in-h2">Hello</sup></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&action=edit&section=1" title="Edit section: Hello">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
	-<h2><a href="#b.22.3EEvilbye" class="mw-headline-anchor" aria-hidden="true" title="Link to this section">§</a><span class="mw-headline" id="b.22.3EEvilbye"><sup> b">Evilbye</sup></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&action=edit&section=2" title="Edit section: b">Evilbye">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
	+<h2><a href="#b.22.3EEvilbye" class="mw-headline-anchor" aria-hidden="true" title="Link to this section">§</a><span class="mw-headline" id="b.22.3EEvilbye"><sup> b">Evilbye</sup></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&action=edit&section=2" title="Edit section: b">Evilbye">edit</a><span class="mw-editsection-bracket">]</span></span></h2>

	!! end

	--
	1.8.4.5

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 96645
Default Alt Text: T73394-escape_gt-wmf21.patch (4 KB)

T73394-escape_gt-wmf21.patchcsteipp (Chris Steipp)Actions

T73394-escape_gt-wmf21.patchView Options

File Metadata

Event Timeline

T73394-escape_gt-wmf21.patch
csteipp (Chris Steipp)
Actions

T73394-escape_gt-wmf21.patch
View Options