Page MenuHomePhabricator

MediaHandler::addMeta() can't decide if values are escaped HTML, literal strings, or wikitext
Open, Needs TriagePublic

Description

To quote from the phpdoc:

	 * @param string $value Thingy goes into a wikitext table; it used to be escaped but
	 *   that was incompatible with previous practise of customized display
	 *   with wikitext formatting via messages such as 'exif-model-value'.
	 *   So the escaping is taken back out, but generally this seems a confusing
	 *   interface.

It appears that in general $value is expected to be wikitext, but in htmlspecialchars is usually used to escape raw data from EXIF tags, etc, instead of wfEscapeWikiText so that URL auto-linking occurs, and parameters to messages are not necessarily consistently escaped.

I think addMeta() should specify that the values are always wikitext, and we should have a helper method somewhere to do the 'almost-escaping' correctly.

Event Timeline

Reedy renamed this task from MediaHandler::addMeta() can't decide if values are escaped HTML, literal strings, or wikitext. to MediaHandler::addMeta() can't decide if values are escaped HTML, literal strings, or wikitext.Oct 28 2020, 8:36 PM
Reedy updated the task description. (Show Details)

Change 637035 had a related patch set uploaded (by C. Scott Ananian; owner: C. Scott Ananian):
[mediawiki/core@master] Ensure FormatMetadata::makeFormattedData always escapes EXIF values

https://gerrit.wikimedia.org/r/637035

Change 637035 merged by jenkins-bot:
[mediawiki/core@master] Ensure FormatMetadata::makeFormattedData always escapes EXIF values

https://gerrit.wikimedia.org/r/637035