| Zabe | |
| Jun 24 2021, 10:46 PM |
| F34662028: 0001-SECURITY-Pass-escaped-HTML-to-FullSearchResultWidget-REL1_31.patch | |
| Sep 29 2021, 10:19 PM |
| F34526984: 0001-SECURITY-Pass-escaped-HTML-to-FullSearchResultWidget.patch | |
| Jun 25 2021, 9:07 AM |
| F34526316: 0001-SECURITY-Pass-escaped-HTML-to-FullSearchResultWidget.patch | |
| Jun 24 2021, 10:48 PM |
| F34526310: xss.png | |
| Jun 24 2021, 10:46 PM |
This is possible, because the date value is not being escaped.
$date = $this->specialPage->getLanguage()->userTimeAndDate( $result->getTimestamp(), $this->specialPage->getUser() );
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Reedy | T266419 Composer 2.0 updates and support | |||
| Resolved | Reedy | T266421 Rebuild mediawiki-vendor on composer 2.0 | |||
| Resolved | Reedy | T275824 Bump wikimedia/composer-merge-plugin in vendor | |||
| Resolved | tstarling | T248908 composer-merge-plugin support for composer 2.0 | |||
| Restricted Task | |||||
| Resolved | Jdforrester-WMF | T279857 Re-build CI containers with Composer 2.x | |||
| Resolved | Jdforrester-WMF | T281294 Drop CI for REL1_31 branch once it's EOL | |||
| Resolved | Aklapper | T230582 Archive Oracle Database project | |||
| Resolved | Aklapper | T230583 Archive MSSQL project | |||
| Resolved | Reedy | T279858 Formally EOL REL1_31 | |||
| Resolved | Reedy | T285404 Release MediaWiki 1.31.16/1.35.4/1.36.2 | |||
| Resolved | Reedy | T285405 Tracking bug for MediaWiki 1.31.16/1.35.4/1.36.2 | |||
| Resolved | Security | Zabe | T285515 CVE-2021-41798: XSS vulnerability in Special:Search |
Tagging @EBernhardson / Discovery-Search for a quick opinion on this security patch. We'd like to deploy this security patch to production but wanted to confirm with someone on the Search Team that the patch seemed sane and there weren't any obvious double-escaping issues or potential issues with hook reuse. Thanks.
+1, Changes looks appropriate to me. It doesn't look like this should result in any double escaping in core code.The hook is documented as having the passed date already HTML encoded, so at least in theory that should be expected by consumers and not double encoded there.
deployed security patch to wmf.11 and wmf.12 -> https://sal.toolforge.org/log/UMnBWXoB8Fs0LHO5Q8wn and https://sal.toolforge.org/log/o8nHWXoB8Fs0LHO5vNDC
https://gerrit.wikimedia.org/r/c/mediawiki/core/+/342282 moved some stuff around, thus the patch above is not going to cleanly apply to REL1_31. So here is the patch for REL1_31.
Change 725055 had a related patch set uploaded (by Reedy; author: Zabe):
[mediawiki/core@REL1_31] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725055 merged by jenkins-bot:
[mediawiki/core@REL1_31] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725061 had a related patch set uploaded (by Reedy; author: Zabe):
[mediawiki/core@REL1_35] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725061 merged by jenkins-bot:
[mediawiki/core@REL1_35] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725066 had a related patch set uploaded (by Reedy; author: Zabe):
[mediawiki/core@REL1_36] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725071 had a related patch set uploaded (by Reedy; author: Zabe):
[mediawiki/core@REL1_37] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725074 had a related patch set uploaded (by Reedy; author: Zabe):
[mediawiki/core@master] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725066 merged by jenkins-bot:
[mediawiki/core@REL1_36] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725071 merged by jenkins-bot:
[mediawiki/core@REL1_37] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta
Change 725074 merged by jenkins-bot:
[mediawiki/core@master] SECURITY: Pass escaped HTML to FullSearchResultWidget::buildMeta