Page MenuHomePhabricator

mw.message.parse() should not escape HTML returned from magic words (e.g. {{PLURAL}})
Open, Needs TriagePublic

Description

If a message contains a magic word, e.g. {{PLURAL}}, that returns HTML, the HTML is not parsed by mw.message.parse().

mw.messages.set( 'foo', '<strong>$1</strong> {{PLURAL:$1|article|articles}}' );
mw.messages.set( 'bar', '{{PLURAL:$1|<strong>$1</strong> article|<strong>$1</strong> articles}}' );
mw.message( 'foo', 42 ).parse(); // Returns '<strong>42</strong> articles', as expected
mw.message( 'bar', 42 ).parse(); // Returns '&lt;strong&gt;42&lt;/strong&gt; articles', unexpected

These two should behave the same, but they don't. In PHP, they do behave the same:

echo ( new RawMessage( '<strong>$1</strong> {{PLURAL:$1|article|articles}}' ) )->numParams( 42 )->parse(); // <strong>42</strong> articles
echo ( new RawMessage( '{{PLURAL:$1|<strong>$1</strong> article|<strong>$1</strong> articles}}' ) )->numParams( 42 )->parse(); // <strong>42</strong> articles

Event Timeline

Is this related to T297905? And is this still a problem?

Yes this is still the case.

AIUI the parser in mediawiki.jqueryMsg.js, it defines the nowiki, html and expression constructs as allowable at the top level but not inside a template. Adding a duplicate no-pipe-allowing version of each would probably enable arbitrary levels of nesting.

Change 884099 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@master] [WIP] mediawiki.jqueryMsg: Allow nesting in templates

https://gerrit.wikimedia.org/r/884099