Page MenuHomePhabricator

ArticlePlaceholder page for Wikidata item with HTML tags in label results in MalformedTitleException
Closed, ResolvedPublic


The art group “!Mediengruppe Bitnik” published a book with the lovely title “<script>!Mediengruppe Bitnik</script>”, which hilariously demonstrates an XSS vulnerability in a whole slew of book shop homepages and related websites (see their Twitter feed for some examples) – including, as the book has a Wikidata item (Q43981055), several Wikidata-related tools, e. g. on (some of them fixed already, some not yet as of this writing).

ArticlePlaceholder is, thankfully, not directly susceptible to XSS, but it does result in a MalformedTitleException (example). It probably shouldn’t – either it should display the actual title, or, if that’s too difficult due to MediaWiki limitations (Wikibase manages it, but afaik it does this by completely overriding the MediaWiki-provided title element, so that it can insert the entity ID), use some replacement for the forbidden characters.

This was discovered by @Sjoerddebruin.


Related Gerrit Patches:
mediawiki/extensions/ArticlePlaceholder : masterProperly catch MalformedTitleException in AboutTopicRenderer

Event Timeline

Restricted Application added a project: Wikidata. · View Herald TranscriptNov 28 2017, 8:29 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Lucas_Werkmeister_WMDE renamed this task from ArticlePlaceholder page for Wikidata item with HTML tags in title results in MalformedTitleException to ArticlePlaceholder page for Wikidata item with HTML tags in label results in MalformedTitleException.Nov 28 2017, 8:29 PM

Change 409898 had a related patch set uploaded (by Thiemo Kreuz (WMDE); owner: Thiemo Kreuz (WMDE)):
[mediawiki/extensions/ArticlePlaceholder@master] Properly catch MalformedTitleException in AboutTopicRenderer

thiemowmde triaged this task as Medium priority.
thiemowmde moved this task from Incoming to Review on the ArticlePlaceholder board.

I was able to reproduce this locally quite easily. It's an actual bug in the code. The code assumed all Wikibase entity labels are valid MediaWiki page names, but that was not always the case. I uploaded a quick fix.

Zoranzoki21 moved this task from Backlog to Doing on the good first task board.May 17 2018, 4:36 PM

Change 409898 merged by jenkins-bot:
[mediawiki/extensions/ArticlePlaceholder@master] Properly catch MalformedTitleException in AboutTopicRenderer

Addshore closed this task as Resolved.Sep 18 2018, 12:32 PM