Page MenuHomePhabricator

Zotero puts raw JS/CSS code in reference template parameters / both citoid and zotero should validate fields to make sure this doesn't occur
Open, Needs TriagePublic

Description

On the English Wikipedia, using Citoid on https://www.milliyet.com.tr/gundem/canan-dagdeviren-kimdir-2392696 produces:

{{Cite web|url=https://www.milliyet.com.tr/gundem/canan-dagdeviren-kimdir-239269|title=Canan Dağdeviren kimdir?|last=QuarkPlayer|first=player-inline {display: inline-block;padding-bottom: 56 25%;position: relative;width: 100%;z-index: 5;} player-box {height: 100%;left: 0;position: absolute;top: 0;width: 100%;}$ ready{quarkPlayer = new|last2=bufferLength:5|website=Milliyet|language=tr|access-date=2020-02-10|last3=false|first3=autoPlay:|last4=false|first4=subTitles:|last5=true|first5=showAds:|last6=false|first6=showNotification:|last7=showB|last8=true|first8=widthSelector:|last9=false|first9=customMenu:}}

A new user tried to add this URL as a reference, and the edit was disallowed by Special:AbuseFilter/139 due to the position: absolute.

The $ ready{quarkPlayer = new stuff appears to be coming from a script tag on the page.

Event Timeline

Mvolz renamed this task from Citoid puts raw JS/CSS code in reference template parameters to Zotero puts raw JS/CSS code in reference template parameters / both citoid and zotero should validate fields to make sure this doesn't occur.Feb 11 2020, 9:49 AM
Mvolz added a project: acl*security.