Page MenuHomePhabricator
Create Task
Maniphest T354361

HtmlHelper::modifyElements(…, $html5format = false) incorrectly encodes HTML entities
Closed, ResolvedPublic
Actions

Description

HtmlHelper::modifyElements(…, $html5format = false) incorrectly encodes HTML entities.

We added this option in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/979165, used it in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/977814, then found the problem in T353920 and had to revert that patch (https://gerrit.wikimedia.org/r/c/mediawiki/core/+/985033).

We should either resolve the problem (and maybe reinstate the reverted patch), or also revert the patch that added the option, since it can't be used safely.

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
HtmlHelper: Fix entity encoding when $html5format = falsemediawiki/coremaster+27 -4
Customize query in gerrit

Related Objects

Event Timeline

matmarex created this task.Jan 4 2024, 4:04 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 4 2024, 4:04 PM
MSantos edited projects, added Content-Transform-Team-WIP; removed Content-Transform-Team.Jan 8 2024, 4:13 PM
matmarex claimed this task.Jan 9 2024, 11:59 PM
matmarex added a comment.Jan 10 2024, 12:06 AM

For the $html5format = false mode, we used RemexCompatFormatter, and therein lies the problem: it is not documented, but that class requires the 'ignoreCharRefs' option in Tokenizer to be used. The option – and this is documented – causes runs of text (in attributes and text nodes) to contain unexpanded character references (HTML entities). RemexCompatFormatter expects that, and so when we were passing it text with decoded entities, it did not encode them, causing the bug.

gerritbot added a comment.Jan 10 2024, 12:11 AM

Change 989258 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] HtmlHelper: Fix entity encoding when $html5format = false

https://gerrit.wikimedia.org/r/989258

gerritbot added a project: Patch-For-Review.Jan 10 2024, 12:11 AM
MSantos added a project: Essential-Work.Jan 15 2024, 3:51 PM
gerritbot added a comment.Feb 15 2024, 3:30 AM

Change 989258 merged by jenkins-bot:

[mediawiki/core@master] HtmlHelper: Fix entity encoding when $html5format = false

https://gerrit.wikimedia.org/r/989258

Maintenance_bot removed a project: Patch-For-Review.Feb 15 2024, 3:30 AM
ReleaseTaggerBot added a project: MW-1.42-notes (1.42.0-wmf.19; 2024-02-20).Feb 15 2024, 4:00 AM
matmarex closed this task as Resolved.Feb 15 2024, 9:45 AM
cscott mentioned this in T363766: Use consistent serializers in OutputTransform stages.Apr 29 2024, 9:39 PM
ABreault-WMF mentioned this in T387130: CVE-2025-32699: Potential javascript injection attack enabled by Unicode normalization in Action API.Mar 7 2025, 3:39 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits