| Dreamy_Jazz | |
| Sep 29 2023, 5:48 PM |
| F37921226: 01-T347746.patch | |
| Oct 2 2023, 9:03 PM |
Steps to reproduce
Expected behaviour: No alert boxes are shown
Observed behaviour: An alert box is shown with the text content parentheses
Extra information
A usage of the parentheses message via ::text is not escaped for display in GlobalBlocking::buildSubtitleLinks.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T2212 Some MediaWiki: messages not safe in HTML (tracking) | |||
| Resolved | Security | sbassett | T347746 CVE-2024-23179: GlobalBlocking subtitle links have i18n-xss via the parentheses message |
I guess OutputPage::addSubtitle could use a taint annotation. I'm unsure if current phan-taint-check can handle String|Message types, although i thought we were getting rid of that in T343849
There are only two instances of the parentheses message within ext:GlobalBlocklist, according to codesearch, and one of them was already escaped. Proposed patch to escape the remaining instance:
change to mark OutputPage::addSubtitle as being an XSS sink https://gerrit.wikimedia.org/r/c/mediawiki/core/+/963341
So, it looks like this got fixed publicly here: https://gerrit.wikimedia.org/r/964029 and then further fixed here: https://gerrit.wikimedia.org/r/965200. So I guess we're good :)