Reminder, the patch for this should not go into gerrit if this is a true XSS. It should be added as an attachment here.

to be clear, this happens in Special:Nearby and mobile search. (and probably watchlist) afaik, there are different/multiple code paths for these.

Can confirm this is on the cluster o_O
Luckily fix is easy:

Let me make a real patch..

Patch is deployed,

19:09 csteipp: deployed patch for T125684

In T125684#1994950, @Jdlrobson wrote:

0001-Don-t-render-wikidata-description-as-HTML.patch1 KBDownload

should be SWATTed.

Security patches don't go out in SWAT windows, they're not publicly scheduled.

In T125684#1994923, @Jdlrobson wrote:

Wow. Seems that we just treat it as HTML and it's not clear why. Can Wikidata descriptions contain safe HTML e.g. <strong> tags?

No. Wikibase terms (labels, descriptions, and aliases) are plain text. They need escaping before they can be used in HTML (or even in wikitext, though that would just get confusing, not dangerous).

@Jdlrobson: thanks for the quick response!

@Krenair: so is the fix in master now? Or should it now go to gerrit?

It will have to go to master via gerrit. If this was code in a release branch it will have to be in the next MW security release before being put into gerrit

And indeed Chris marked this as a release blocker

I'm not sure how we're handling mobilefrontend-- @demon, do we want to wait for the next release, or should they just push this now?

In T125684#1995817, @csteipp wrote:

I'm not sure how we're handling mobilefrontend-- @demon, do we want to wait for the next release, or should they just push this now?

It's not bundled, so I'd just push and announce it publicly for those using it.

It's not bundled, so I'd just push and announce it publicly for those using it.

Cool. So @Jdlrobson, merge in gerrit, close and make this task public, and send a message about it to wikitech-l (and maybe mediawiki-l). Can you or someone on your team handle that?

Fixed and merged in https://gerrit.wikimedia.org/r/#/c/268424/

Email sent to wikitech-l and mobile-l - "MobileFrontend+Wikibase security patch"
@phuedx could you sign off?

Has to be public before @phuedx can see it.

I've verified that neither search nor the watchlist are affected on the Beta Cluster. I updated Q77282 and tested both features. However, it's hard to verify Special:Nearby as it's hitting the enwiki API rather than the local API.