https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GoogleAnalyticsMetrics/+/905661

			return '<strong class="error">' .
				wfMessage( 'googleanalyticsmetrics-invalid-url' )->text() .
				'</strong>';

Doesn’t this need to be ->parse() or ->escaped() to prevent HTML injection from the googleanalyticsmetrics-invalid-url message?

In T333980#8755485, @Lucas_Werkmeister_WMDE wrote:

			return '<strong class="error">' .
				wfMessage( 'googleanalyticsmetrics-invalid-url' )->text() .
				'</strong>';

Doesn’t this need to be ->parse() or ->escaped() to prevent HTML injection from the googleanalyticsmetrics-invalid-url message?

No, because parser functions (unlike tag extensions) return wikitext if you return a string from them. So the return value is interpreted as being wikitext and does all normal wikitext escaping.

I see, thanks.

@Mstyles Can this be added to next extension security supplement?

In T333980#8755512, @Bawolff wrote:

@Mstyles Can this be added to next extension security supplement?

Yes, added: T333626. Also going to just make this public now.