Parameters descriptions allow raw HTML:
{ "params": { "1": { "description": "<a onclick=\"alert('XSS')\">Test</a>" } } }
The link is directly inserted in the description table, clicking on it executes the JavaScript script.
Description
Description
Related Objects
Related Objects
Event Timeline
Comment Actions
I checked the rest of the getHtml() method for similar issues and found none.
The structure of the code that generates the table is a little hard to read.
Comment Actions
It looks like 402d95ff6b27800ecbd38e7be1eea18006060752 changed that to be a rawElement.
Timo, can you look at @Bawolff's patch, and make sure it doesn't break something you were accounting for when you did that?
Comment Actions
<Krinkle> csteipp: Looks good. Was not intended to be rawElement. I think an earlier version of that patch passed parameter and used escaped() and then one changed to text() but the other remained rawElement. Not relied upon.
Comment Actions
(just prefixed the patch description with SECURITY to make it easy to see in git)
LGTM
Comment Actions
Re-deployed. I'm also going to publicize this momentarily.
[20:48] logmsgbot !log bawolff@tin Synchronized php-1.31.0-wmf.12/extensions/TemplateData/TemplateDataBlob.php: T118682 (duration: 00m 52s)
and
This comment was removed by Bawolff.