Add raw HTML messages in WMF-deployed extensions to $wgRawHtmlMessages
Open, NormalPublic

Description

Following up on the work being done for T45646, I've identified the following raw HTML messages in WMF-deployed extensions:

  • WikimediaMessages
    • wikimedia-mobile-license-links
    • wikimedia-copyright
    • wikidata-copyright
    • wikimedia-feedback-termsofuse
    • Others?
  • JsonConfig
    • jsonconfig-license
    • Others?
  • TimedMediaHandler
    • some raw <a> tags can be seen in the i18n file, I haven't gone through to check which other messages are raw HTML
    • Others?
  • WikiEditor
    • all help messages (wikieditor-toolbar-help-*)
    • all titles of jQuery UI dialogs (wikieditor-toolbar-tool-*-title)
    • Others?
  • Gadgets
    • MediaWiki:Gadgets-definition (and possibly others?)
    • Others?

These messages should be added to the raw HTML messages list in extension.json, support for which is being added by @Tgr in his patch.

Needless to say, this list is not exhaustive. There are probably many other raw HTML messages, and a proper audit should be done. Perhaps @Bawolff, who wrote phan-taint-check-plugin, might have thoughts on this?

TTO created this task.Aug 2 2018, 10:42 AM
TTO triaged this task as Normal priority.
Tgr added a comment.Aug 5 2018, 11:10 AM
This comment was removed by Tgr.

Change 450445 had a related patch set uploaded (by Gergő Tisza; owner: Gergő Tisza):
[mediawiki/extensions/WikimediaMessages@master] Mark some raw HTML messages

https://gerrit.wikimedia.org/r/450445

Change 450449 had a related patch set uploaded (by Gergő Tisza; owner: Gergő Tisza):
[mediawiki/extensions/JsonConfig@master] Mark some raw HTML messages

https://gerrit.wikimedia.org/r/450449

RP88 added a subscriber: RP88.Mon, Aug 27, 3:01 PM
Jdforrester-WMF updated the task description. (Show Details)

Change 455603 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[mediawiki/extensions/Gadgets@master] Mark MediaWiki:Gadgets-definition as a raw HTML message

https://gerrit.wikimedia.org/r/455603

Change 450445 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@master] Mark some raw HTML messages

https://gerrit.wikimedia.org/r/450445

Change 450449 merged by jenkins-bot:
[mediawiki/extensions/JsonConfig@master] Mark some raw HTML messages

https://gerrit.wikimedia.org/r/450449

Change 456030 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[mediawiki/extensions/WikiEditor@master] Mark some messages as raw HTML

https://gerrit.wikimedia.org/r/456030

Change 455603 merged by jenkins-bot:
[mediawiki/extensions/Gadgets@master] Mark MediaWiki:Gadgets-definition as a raw HTML message

https://gerrit.wikimedia.org/r/455603

PerfektesChaos added a subscriber: PerfektesChaos.EditedSat, Sep 15, 9:13 AM

I am happy with the current task.

However, I would like to see a deprecation process initiated now.

  • WMF projects which make use of unsanitizable raw HTML today shall be informed and asked to convert obeying wikitext limitations.
  • Projects in the outer world shall be informed that raw HTML is deprecated and will fade out within two releases.
  • If not defined yet a $wgHtmlHead feature for <meta> stuff might be introduced for deliberate configuration, available for site sysops only rather than any wiki page.
  • TimedMediaHandler and WikiEditor will fade out in the long run, as far as I know. No need to hurry.

The final target should be to sanitize every system message, but it might take some years to reach that point. However, it is more clear if there are no exceptions and backdoors and hidden sophisticated bypasses.