Introduced in T235754: Implement haswbstatement:P<depicts>=Q<your term> autocomplete suggestions:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Escape labels in HTML output | mediawiki/extensions/WikibaseMediaInfo | master | +1 -1 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Reedy | T240392 Release MediaWiki 1.31.7/1.33.3/1.34.1 | |||
| Resolved | sbassett | T240400 Write and send supplementary release announcement for extensions and skins with security patches (MediaWiki 1.31.7/1.33.3/1.34.1) | |||
| Resolved | matthiasmullie | T240773 Exposed HTML in WikibaseMediaInfo autocomplete suggestions (CVE-2020-6163) |
[@Bugreporter: Please stop pinging people one by one and creating notification emails for each comment. Thanks for your understanding.]
@matthiasmullie - Is there a gerrit patch set or security patch we could reference here? Backports to supported release branches or a CVE? The Security-Team can help with the latter if need be. Thanks.
Yes - not sure why gerritbot didn't pick it up, but here's the patch: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseMediaInfo/+/558203
So it doesn't look like templates/search/PropertySuggestionsWidget.mustache+dom existed in REL1_34 or previous, so no backports necessary. I'm going make the task public now and request a CVE.