Page MenuHomePhabricator

SiteMatrix uses raw HTML messages
Closed, ResolvedPublic

Description

Relevant code snippet:

				$langDisplay .= $this->msg( 'word-separator' )->text() .
					$this->msg( 'parentheses', $localLanguageNames[$lang] )->text();
			}
			$s .= '<td>' . $anchor . Html::rawElement( 'strong', $attribs, $langDisplay ) . '</td>';
<checkstyle version="6.5">
  <file name="./includes/SpecialSiteMatrix.php">
    <error line="53" severity="warning" message="Calling method \Html::rawElement() in \SpecialSiteMatrix::execute that outputs using tainted argument $[arg #2]." source="SecurityCheck-DoubleEscaped"/>
    <error line="149" severity="warning" message="Calling method \OutputPage::addHTML() in \SpecialSiteMatrix::execute that outputs using tainted argument $s. (Caused by: ./includes/SpecialSiteMatrix.php +22; ./includes/SpecialSiteMatrix.php +34; ./includes/SpecialSiteMatrix.php +36; ./includes/SpecialSiteMatrix.php +46; ./includes/SpecialSiteMatrix.php +67; ./includes/SpecialSiteMatrix.php +74; ./includes/SpecialSit...)" source="SecurityCheck-XSS"/>
  </file>
</checkstyle>