An example:
- With a plain adminstrator account (no editsitejs/editsitecss rights), replace your MediaWiki:Summary-preview with this content:
[javascript:alert("XSS"); click here]- Check "Show previews without reloading the page" in your preferences
- In the 2010 editor, edit any page.
- With a non-blank summary, click "Preview"
- Click on the "click here" below the edit summary box
What's going on here:
> mw.messages.set('m', '[javascript:alert("XSS"); click here]'); mw.message('m').parse();
"<a href=\"javascript:alert("XSS");\">click here</a>"Another example: (not an XSS, but privacy loss)
> mw.messages.set('m', '<span style="background:url(http://example.com/tracker.jpg)">x</span>'); mw.message('m').parse();
"<span style=\"background:url(http://example.com/tracker.jpg)\">x</span>"So it looks like parse()isn't really even trying to produce secure output, and, indeed, I can find nothing at Manual:Messages_API which claims that the output of parse() is safe.
But people have been using it as just that anyway. So effectively there are many raw-ish HTML messages that aren't marked as such.
So either jqueryMsg needs to implement a full sanitizer, or a whole lot of messages, across many extensions, need to be marked as raw HTML (and the manual updated).
There's also something funky going on with how parameters are processed:
mw.messages.set('m', '[[x]] $1'); mw.message('m', '<span onmouseover="alert(\'XSS\')">x</span>').parse()
"<a title=\"x\" href=\"/wiki/x\">x</a> <span onmouseover=\"alert('XSS')\">x</span>"
mw.messages.set('m', 'x $1'); mw.message('m', '<span onmouseover="alert(\'XSS\')">x</span>').parse()
"x <span onmouseover=\"alert('XSS')\">x</span>"So it looks like sometimes parameters aren't escaped properly. This one is certainly more scary-looking, and might be exploitable by any unprivileged user, but I can't find a working example.