Page MenuHomePhabricator
Create Task
Maniphest T11403

Special:Search accepts and reprints queries containing newlines, arbitrary wikitext, and other garbage
Closed, ResolvedPublic
Actions

Description

Author: GNUtoo

Description:
the search function should not allow such thing:
http://en.wikipedia.org/w/index.php?title=Special%3ASearch&a
mp;search=pastebin+list%0D%0A+*+framework-3.0-beta-3-svn.tar
.gz+RMD160+%3B-%29+...%0D%0A+*+framework-3.0-beta-3-svn.tar.
gz+SHA1+%3B-%29+...%0D%0A+*+framework-3.0-beta-3-svn.tar.gz+
SHA256+%3B-%29+...%0D%0A+*+framework-3.0-beta-3-svn.tar.gz+s
ize+%3B-%29+...%0D%0A+*+checking+ebuild+checksums+%3B-%29+..
.%0D%0A+*+checking+auxfile+checksums+%3B-%29+...%0D%0A+*+che
cking+miscfile+checksums+%3B-%29+...%0D%0A+*+checking+framew
ork-3.0-beta-3-svn.tar.gz+%3B-%29+...%0D%0A%3E%3E%3E+Unpacki
ng+source...%0D%0A%3E%3E%3E+Unpacking+framework-3.0-beta-3-s
vn.tar.gz+to+%2Fvar%2Ftmp%2Fportage%2Fnet-analyzer%2Fmetaspl
oit-3.0_beta3%2Fwork%0D%0A%3E%3E%3E+Source+unpacked.%0D%0A%3
E%3E%3E+Compiling+source+in+%2Fvar%2Ftmp%2Fportage%2Fnet-ana
lyzer%2Fmetasploit-3.0_beta3%2Fwork%2Fframework-3.0-beta-3+.
..%0D%0A+*+Applying+metasploit-gentoo.patch+...%0D%0A%0D%0A+
*+Failed+Patch%3A+metasploit-gentoo.patch+%21%0D%0A+*++%28+%
2Fusr%2Foverlay%2Fnet-analyzer%2Fmetasploit%2Ffiles%2Fmetasp
loit-gentoo.patch+%29%0D%0A+*%0D%0A+*+Include+in+your+bugrep
ort+the+contents+of%3A%0D%0A+*%0D%0A+*++%0D%0A%2Fvar%2Ftmp%2
Fportage%2Fnet-analyzer%2Fmetasploit-3.0_beta3%2Ftemp%2Fmeta
sploit-gentoo.patch-24652.out%0D%0A%0D%0A%0D%0A%21%21%21+ERR
OR%3A+net-analyzer%2Fmetasploit-3.0_beta3+failed.%0D%0ACall+
stack%3A%0D%0A++ebuild.sh%2C+line+1614%3A+++Called+dyn_compi
le%0D%0A++ebuild.sh%2C+line+971%3A+++Called+qa_call+%27src_c
ompile%27%0D%0A++environment%2C+line+2971%3A+++Called+src_co
mpile%0D%0A++metasploit-3.0_beta3.ebuild%2C+line+37%3A+++Cal
led+epatch%0D%0A%27%2Fusr%2Foverlay%2Fnet-analyzer%2Fmetaspl
oit%2Ffiles%2Fmetasploit-gentoo.patch%27%0D%0A++eutils.eclas
s%2C+line+341%3A+++Called+die%0D%0A%0D%0A%21%21%21+Failed+Pa
tch%3A+metasploit-gentoo.patch%21%0D%0A%21%21%21+If+you+need
+support%2C+post+the+topmost+build+error%2C+and+the+call+sta
ck+if%0D%0Arelevant.%0D%0A%21%21%21+A+complete+build+log+is+
located+at%0D%0A%27%2Fvar%2Ftmp%2Fportage%2Fnet-analyzer%2Fm
etasploit-3.0_beta3%2Ftemp%2Fbuild.log%27.%0D%0A%0D%0Apasteb
in&fulltext=Search

Version: unspecified
Severity: minor
URL: http://en.wikipedia.org/w/index.php?title=Special%3ASearch&search=pastebin+list%0D%0A+*+framework-3.0-beta-3-svn.tar.gz+RMD160+%3B-%29+...%0D%0A+*+framework-3.0-beta-3-svn.tar.gz+SHA1+%3B-%29+...%0D%0A+*+framework-3.0-beta-3-svn.tar.gz+SHA256+%3B-%29+...%0D%0A+*+framework-3.0-beta-3-svn.tar.gz+size+%3B-%29+...%0D%0A+*+checking+ebuild+checksums+%3B-%29+...%0D%0A+*+checking+auxfile+checksums+%3B-%29+...%0D%0A+*+checking+miscfile+checksums+%3B-%29+...%0D%0A+*+checking+framework-3.0-beta-3-svn.tar.gz+%3B-%29+...%0D%0A%3E%3E%3E+Unpacking+source...%0D%0A%3E%3E%3E+Unpacking+framework-3.0-beta-3-svn.tar.gz+to+%2Fvar%2Ftmp%2Fportage%2Fnet-analyzer%2Fmetasploit-3.0_beta3%2Fwork%0D%0A%3E%3E%3E+Source+unpacked.%0D%0A%3E%3E%3E+Compiling+source+in+%2Fvar%2Ftmp%2Fportage%2Fnet-analyzer%2Fmetasploit-3.0_beta3%2Fwork%2Fframework-3.0-beta-3+...%0D%0A+*+Applying+metasploit-gentoo.patch+...%0D%0A%0D%0A+*+Failed+Patch%3A+metasploit-gentoo.patch+%21%0D%0A+*++%28+%2Fusr%2Foverlay%2Fnet-analyzer%2Fmetasploit%2Ffiles%2Fmetasploit-gentoo.patch+%29%0D%0A+*%0D%0A+*+Include+in+your+bugreport+the+contents+of%3A%0D%0A+*%0D%0A+*++%0D%0A%2Fvar%2Ftmp%2Fportage%2Fnet-analyzer%2Fmetasploit-3.0_beta3%2Ftemp%2Fmetasploit-gentoo.patch-24652.out%0D%0A%0D%0A%0D%0A%21%21%21+ERROR%3A+net-analyzer%2Fmetasploit-3.0_beta3+failed.%0D%0ACall+stack%3A%0D%0A++ebuild.sh%2C+line+1614%3A+++Called+dyn_compile%0D%0A++ebuild.sh%2C+line+971%3A+++Called+qa_call+%27src_compile%27%0D%0A++environment%2C+line+2971%3A+++Called+src_compile%0D%0A++metasploit-3.0_beta3.ebuild%2C+line+37%3A+++Called+epatch%0D%0A%27%2Fusr%2Foverlay%2Fnet-analyzer%2Fmetasploit%2Ffiles%2Fmetasploit-gentoo.patch%27%0D%0A++eutils.eclass%2C+line+341%3A+++Called+die%0D%0A%0D%0A%21%21%21+Failed+Patch%3A+metasploit-gentoo.patch%21%0D%0A%21%21%21+If+you+need+support%2C+post+the+topmost+build+error%2C+and+the+call+stack+if%0D%0Arelevant.%0D%0A%21%21%21+A+complete+build+log+is+located+at%0D%0A%27%2Fvar%2Ftmp%2Fportage%2Fnet-analyzer%2Fmetasploit-3.0_beta3%2Ftemp%2Fbuild.log%27.%0D%0A%0D%0Apastebin&fulltext=Search

Details

Reference
bz9403

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:39 PM
• bzimport added a project: MediaWiki-Search.
• bzimport set Reference to bz9403.
• bzimport added a subscriber: Unknown Object (MLST).
• bzimport created this task.Mar 23 2007, 8:49 PM
• bzimport added a comment.Mar 23 2007, 8:50 PM

GNUtoo wrote:

tinyurl version
http://tinyurl.com/2n75r4

• bzimport added a comment.Mar 23 2007, 9:01 PM

ayg wrote:

Basically Special:Search doesn't filter on insane queries containing, e.g., newlines, and it
seems to render it all as wikitext (try:

http://en.wikipedia.org/w/
index.php?title=Special%3ASearch&search=%0D%0A*+This+is+an+unordered+list%0D%0A*+Another+item

and look at the top of the page, "you searched for"). Some sanity checks would be good to
add here.

• bzimport added a comment.Mar 23 2007, 9:06 PM

ayg wrote:

Alternative URL that could confuse silly people: http://tinyurl.com/2exfw5. Some quote marks
around the search terms wouldn't hurt. :P

• brooke added a comment.Mar 19 2008, 12:35 AM

Now strips newlines in r32148.

(Note this is for internal search engine; old LuceneSearch probably still won't do it. We won't be using it in a couple days.)

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits