| • Mattflaschen-WMF | |
| Jul 28 2015, 8:40 PM |
| F8516186: 0001-SECURITY-script-tags-should-be-stripped-from-extract.patch | |
| Jun 23 2017, 6:12 PM |
| F192692: Screenshot 2015-07-15 13.44.24.png | |
| Aug 13 2015, 5:19 AM |
Arguably they should not be there to begin with, but this has affected at least two extensions, so probably worth dealing with here:
T105924: Graph extension should exclude scripts tags so they will not be parsed by TextExtracts
T107170: Flow: Data Model JavaScript, including tokens, appears in TextExtracts and HoverCards
It's not always a security issue, but always a UX one.
Only for Flow, not T105924: Graph extension should exclude scripts tags so they will not be parsed by TextExtracts if I understand correctly that the "Graphs" page (see F192692) is wikitext content model. Also not the general issue.
Just found this on my travels. Is this still a problem? Is it really low? Is this a problem with the Graph extension or TextExtracts or both?
I can't replicate this in the wild, but I see how this is happening.
This relates to T167852 but is much more easily fixed. We need to update wgto include script tags so they get stripped from the extract.
My plan is to:
Postponed from today's swat, pending some discussion of how to not do it via InitialiseSettings
Per https://phabricator.wikimedia.org/T107206#3375393 let us know what you want to do!
It hasn't yet, I postponed it because we need a discussion about how to do it instead :)
Sorry, didn't see this (only happened to see this patch on the Phabricator web interface). I'm not checking Phabricator mail as much these days, so IRC/direct email is better for something like that.
My understanding is that this is theoretical, and we're not currently aware of any examples of WMF extensions that would cause this?
I think stripping <script> tags is generally a good idea and similar to how the extension already removes <style>. To be really paranoid, I would add <input> (If an extension added a form to a wikipage, there could be a hidden input tag containing a token).
To be further paranoid, we may want ExtractFormatter::filterContent() to also remove any attributes starting with data or on. (data in case they contain sensitive data. on for scripts)
Instead of InitialiseSettings.php, I would suggest just adding the additional items to extension.json directly, and deploying that. I think its fine to do this as a public gerrit patch, provided the patch is merged pretty immediately after the patch is made public, and an announcement email is sent to wikitech-l/mediawiki-l advising people to upgrade. If for whatever reason we can't do the public announcement immediately after deploying, then it should be deployed as a secret security patch until we can do that announcement.
Going to swat this in 7 minutes time and send an e-mail to wikitech-l & mediawiki-l advising 3rd parties to upgrade.
The following fix has been deployed: https://gerrit.wikimedia.org/r/362252
I've sent an email to mailing lists.
Change 362390 had a related patch set uploaded (by Brian Wolff; owner: Jdlrobson):
[mediawiki/extensions/TextExtracts@REL1_29] Play things safe when stripping HTML
Change 362391 had a related patch set uploaded (by Brian Wolff; owner: Jdlrobson):
[mediawiki/extensions/TextExtracts@REL1_28] Play things safe when stripping HTML
Change 362392 had a related patch set uploaded (by Brian Wolff; owner: Jdlrobson):
[mediawiki/extensions/TextExtracts@REL1_27] Play things safe when stripping HTML
Change 362390 merged by jenkins-bot:
[mediawiki/extensions/TextExtracts@REL1_29] Play things safe when stripping HTML
Change 362392 merged by jenkins-bot:
[mediawiki/extensions/TextExtracts@REL1_27] Play things safe when stripping HTML
Change 362391 merged by jenkins-bot:
[mediawiki/extensions/TextExtracts@REL1_28] Play things safe when stripping HTML