The file includes/PF_AutoeditAPI.php calls DOMDocument::loadHTML() in a possibly-unsafe way. That call should be modified using these guidelines:
https://www.mediawiki.org/wiki/XML_External_Entity_Processing
Description
Description
Details
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Secure call to DOMDocument::loadHTML() | mediawiki/extensions/PageForms | master | +3 -1 |
Related Objects
Related Objects
- Mentioned In
- rEPFM54ebd921f42d: Final NoteDb migration updates
T160257: Proposal : Adding Custom features while upgrading and updating Quiz extension - Gsoc17
rEPFMf95957aa0c21: Secure call to DOMDocument::loadHTML()
rEPFMdfa40c0f8e4c: Secure call to DOMDocument::loadHTML()
T63989: Add a spreadsheet interface for modifying multiple pages to the Page Forms extension
Event Timeline
Comment Actions
Change 342439 had a related patch set uploaded (by Harjotsingh):
[mediawiki/extensions/PageForms] Secure call to DOMDocument::loadHTML()
Comment Actions
@Yaron_Koren no, I didn't test for XXE vulnerability.I just followed the prevention pattern specified https://www.mediawiki.org/wiki/XML_External_Entity_Processing.
Is there a way I could test for the vulnerability ?
Comment Actions
I don't know how to test for the vulnerability either - though that would be ideal. But the most important thing is just to make sure that the code still works now.
Comment Actions
I only tested autoedit for modifying pages automatically as specified here : https://www.mediawiki.org/wiki/Extension:Page_Forms/Linking_to_forms
Comment Actions
Change 342439 merged by jenkins-bot:
[mediawiki/extensions/PageForms] Secure call to DOMDocument::loadHTML()