NOTE: The affected feature is enabled on Test Wikidata in the production cluster, as well as on Beta Wikidata (but not on production real Wikidata). Only interface admins On Test Wikidata, admins, interface admins and Wikidata staff have the right to edit the relevant messages. (Interface admins can edit common.js anyways, but regular admins can’t.)
If
- both Citoid and Wikibase are loaded, and
- $wgWBRepoSettings['enableRefTabs'] is set to true (it’s false by default), and
- a $wgWBCitoidFullRestbaseURL is configured (e.g. 'https://en.wikipedia.org/api/rest_'),
then the contents of the messages citoid-wb-pendingdialog-message and citoid-wb-pendingdialog-title will be injected into the page HTML by Citoid’s JS when an item is loaded (even if Citoid doesn’t have anything to do yet), without any escaping. If the messages are set to e.g. <script>alert('xss')</script>, either in en.json or in the MediaWiki: namespace, then that alert will fire.
The messages are being used here:
modules/wikibase/wb.CitoidPendingDialog.js
this.waitingPanel = new OO.ui.PanelLayout( { padded: true, expanded: false } ); this.waitingPanel.$element.append( OO.ui.deferMsg( 'citoid-wb-pendingdialog-message' ) ); this.errorPanel = new OO.ui.PanelLayout( { padded: true, expanded: false } ); this.errorPanel.$element.append( OO.ui.deferMsg( 'citoid-wb-pendingdialog-error' ) );
I’m guessing that OO.ui.deferMsg() isn’t supposed to be used like this (though its documentation is pretty sparse imho).