$adMsg should probably also be ->escaped() as well for the href. FILTER_VALIDATE_URL allows urls like https://example.com/"><script>alert(1)</script>. Additionally, if you assume the message is not trusted, you can have javascript scheme urls to get xss e.g. javascript://%0aalert(1) passes FILTER_VALIDATE_URL.

You could potentially use $url = Sanitizer::validateAttributes( [ 'href' => $adMsg->text() ] )['href'] ?? false; and then htmlspecialchars the result if its not false (I did not test that).

In T306815#7881305, @Bawolff wrote:

$adMsg should probably also be ->escaped() as well for the href. FILTER_VALIDATE_URL allows urls like https://example.com/"><script>alert(1)</script>. Additionally, if you assume the message is not trusted, you can have javascript scheme urls to get xss e.g. javascript://%0aalert(1) passes FILTER_VALIDATE_URL.

Thank you for this, I learned something new! 👍

You could potentially use $url = Sanitizer::validateAttributes( [ 'href' => $adMsg->text() ] )['href'] ?? false; and then htmlspecialchars the result if its not false (I did not test that).

This seems to have done the trick for good, though I had to pass in [ 'href' ] as a 2nd param to the validateAttributes method because it apparently uses a whitelist-based approach, so you have to tell it explicitly what attributes are OK and what are not.

Here's the current patch that I have, would definitely appreciate your thoughts on it! 😃

@@ -76,10 +104,13 @@ class SkinNimbus extends SkinTemplate {
         */
        function advertiseLink() {
                $link = '';
-               $adMsg = wfMessage( 'nimbus-advertise-url' )->inContentLanguage();
+               $adMsg = $this->msg( 'nimbus-advertise-url' )->inContentLanguage();
                if ( !$adMsg->isDisabled() ) {
-                       $link = '<a href="' . $adMsg->text() . '" rel="nofollow">' .
-                               wfMessage( 'nimbus-advertise' )->plain() . '</a>';
+                       $url = Sanitizer::validateAttributes( [ 'href' => $adMsg->text() ], [ 'href' ] )['href'] ?? false;
+                       if ( $url ) {
+                               $link = '<a href="' . htmlspecialchars( $url, ENT_QUOTES ) . '" rel="nofollow">' .
+                                       $this->msg( 'nimbus-advertise' )->escaped() . '</a>';
+                       }
                }
                return $link;
        }

Looks good :)

Thanks, all. Tracking for the next supplemental security release: T305209.