Page MenuHomePhabricator

Raw HTML in MobileFrontend
Closed, ResolvedPublic3 Estimate Story Points

Description

The following interface messages seem to be treated as raw HTML in MobileFrontend, but aren't listed in RawHtmlMessages:

mobile-frontend-categories-add-heading
mobile-frontend-categories-add-wait
mobile-frontend-categories-heading
mobile-frontend-changeslist-nocomment
mobile-frontend-contributions-404-desc
mobile-frontend-editor-anonwarning
mobile-frontend-editor-editing-page
mobile-frontend-editor-licensing-with-terms
mobile-frontend-editor-previewing-page
mobile-frontend-editor-summary
mobile-frontend-editor-summary-request
mobile-frontend-editor-wait
mobile-frontend-talk-add-overlay-submit
mobile-frontend-talk-topic-wait

There are probably more. I created this list by adding an <img> to every single MediaWiki page corresponding to the MobileFrontend /i18n/en.json, randomly clicking on buttons in the mobile editor, then grepping apache logs for .jpg requests. I'm sure I haven't displayed everything, yet.

MobileFrontend may also be treating some non-MF interface messages as HTML; I haven't looked yet.

Developer notes

https://www.mediawiki.org/wiki/Manual:$wgRawHtmlMessages/en

Details

Related Gerrit Patches:
mediawiki/extensions/MobileFrontend : REL1_32List known raw html messages
mediawiki/extensions/MobileFrontend : REL1_31List known raw html messages
mediawiki/extensions/MobileFrontend : REL1_34List known raw html messages
mediawiki/extensions/MobileFrontend : REL1_33List known raw html messages
mediawiki/extensions/MobileFrontend : masterList known raw html messages
mediawiki/extensions/MobileFrontend : wmf/1.35.0-wmf.11List known raw html messages

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 11 2019, 8:32 PM
Urbanecm triaged this task as High priority.Dec 11 2019, 9:46 PM
Urbanecm added a subscriber: Florian.
Jdlrobson updated the task description. (Show Details)Dec 18 2019, 5:28 PM
ovasileva set the point value for this task to 3.Dec 18 2019, 5:36 PM
nray added a comment.Dec 19 2019, 7:31 PM

Attached is the patch to add all of the listed messages + 1 other one in the RawHtmlMessages array. I'm not sure if putting the patch here matters since I already screwed up (I think) and pushed the patch to gerrit (https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/MobileFrontend/+/559557/) before realizing this task was set to hidden. I'll try to be much more careful about this in the future.

@nray - Yep, once it goes to gerrit or a public Phab task, it's there forever unless an appropriately-privileged user completely removes it. Though even in that case, it's still been publicly-exposed for a while. We all make mistakes though :) And this probably isn't quite as critical IMO since I believe this issue is only exploitable by sysops/editinterface users right now, so at least somewhat-trusted users. If you want to update your gerrit patch set soon to the appropriate revision of extension.json and let CI run (it'd be nice to prevent any unintended brokenness via tests), @Reedy or I can +2 and deploy today, which we probably should.

nray added a comment.Dec 19 2019, 9:36 PM

@sbassett gerrit patch has now been updated at https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/MobileFrontend/+/559557/ and ready to be deployed. Thank you!

Patch merged on master and wmf.11 and deployed to production. Backports to release branches can happen tomorrow (or later), I doubt this needs a CVE as I view it more as code hardening, but I could probably be convinced otherwise.

nray removed nray as the assignee of this task.Dec 20 2019, 12:59 AM

@sbassett are you okay with me resolving this task or is there more to be done?

@Jdlrobson - it'd be nice to get backports to supported release branches completed - I can maybe get those started in gerrit now. I think we can make the task public now (since it's been patched and deployed within production) but I'd wait to resolve it if we can get the backports completed first.

sbassett lowered the priority of this task from High to Medium.Jan 7 2020, 6:37 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

Change 562577 had a related patch set uploaded (by SBassett; owner: Nray):
[mediawiki/extensions/MobileFrontend@REL1_34] List known raw html messages

https://gerrit.wikimedia.org/r/562577

Change 562581 had a related patch set uploaded (by SBassett; owner: Nray):
[mediawiki/extensions/MobileFrontend@REL1_33] List known raw html messages

https://gerrit.wikimedia.org/r/562581

Change 562582 had a related patch set uploaded (by SBassett; owner: Nray):
[mediawiki/extensions/MobileFrontend@REL1_32] List known raw html messages

https://gerrit.wikimedia.org/r/562582

Change 562583 had a related patch set uploaded (by SBassett; owner: Nray):
[mediawiki/extensions/MobileFrontend@REL1_31] List known raw html messages

https://gerrit.wikimedia.org/r/562583

Change 562581 merged by jenkins-bot:
[mediawiki/extensions/MobileFrontend@REL1_33] List known raw html messages

https://gerrit.wikimedia.org/r/562581

Change 562577 merged by SBassett:
[mediawiki/extensions/MobileFrontend@REL1_34] List known raw html messages

https://gerrit.wikimedia.org/r/562577

Change 562583 merged by SBassett:
[mediawiki/extensions/MobileFrontend@REL1_31] List known raw html messages

https://gerrit.wikimedia.org/r/562583

Change 562582 merged by SBassett:
[mediawiki/extensions/MobileFrontend@REL1_32] List known raw html messages

https://gerrit.wikimedia.org/r/562582

sbassett closed this task as Resolved.Jan 14 2020, 4:49 PM
sbassett assigned this task to nray.