Page MenuHomePhabricator

Leading asterisk, hash, colon or semicolon in parser function output incorrectly parsed as if beginning a line
Open, MediumPublic


If the output of a parser function or magic word begins with "*", "#", ":" or ";", it will be parsed as a list item even if it's not actually at the beginning of a line.

This bug has been observed on both 1.16.1, current wikimedia-deployment and 1.18-svn. It can be easily reproduced by parsing e.g. "foo{{plural:1|*bar}}", which should yield "foo*bar". Instead, the string gets incorrectly parsed as "foo<ul><li>bar</li></ul>".

Another way to observe this bug (and the context in which it was first noticed) is to visit a nonexistent page with a leading asterisk in its title: the {{PAGENAME}} magic word in the noarticletext message also triggers this bug if its output begins with an asterisk.

Version: 1.18.x
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:13 PM
bzimport added a project: MediaWiki-Parser.
bzimport set Reference to bz26781.
bzimport added a subscriber: Unknown Object (MLST).

sounds like Bug 12974

There seem to actually be two bugs here. r80511 and r80512 should fix the issue of insufficient escaping of the output of {{PAGENAME}} and friends. Meanwhile, r80430 addresses the more general issue of handling template / parser function output beginning with "*#;:" characters (which seems to be a regression from bug 529). Assuming that neither fix is reverted, I think this bug can probably be closed.

feel free to re-open if they are reverted.

SoWhy reopened this task as Open.Jun 2 2017, 1:45 PM
SoWhy added a subscriber: SoWhy.

Sorry to reopen this old task but apparently {{REVISIONUSER}} has been forgotten when fixing this back in 2011. Can someone take care of that?

See also discussion at en-wiki:

Here are test cases for various magic words:

None of appear to use escaping but maybe that is intentional.