Page MenuHomePhabricator

Automatically allow id HTML attribute in message translations
Closed, ResolvedPublicBUG REPORT

Description

The i18n bot change https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Collection/+/998718 had to be manually merged because the message translation included a <span id="renderingProgress"> tag, which is unrecognized by Jenkins job configuration:

[mediawiki-i18n-check-docker] $ /bin/bash /tmp/jenkins979587789070611556.sh
+ cd src
++ pwd
+ git config --global --add safe.directory /srv/jenkins/workspace/mediawiki-i18n-check-docker/src
++ mktemp
+ additions=/tmp/tmp.2Rqe67B4ML
+ git show FETCH_HEAD -U0
+ grep '^+'
+ contains_disallowed_html /tmp/tmp.2Rqe67B4ML
+ cat /tmp/tmp.2Rqe67B4ML
+ sed -E -e 's/<\/? ?(abbr|span|br|strong|em|pre|nowiki|charinsert|b|del|code|kbd|p|tt|div|i|big|sup|sub|samp|var|small|h1|h2|h3|h4|u|ol|ul|li|mark|user|page|hr|templatestyles|NDL|math|syntaxhighlight|templatedata|pagelist|bdi|ref|dt|dd|dl)( ((class|title|lang|xml:lang|dir|xmlns|display|alttext)=\\?["'\''][^=<>"'\'']*\\?["'\'']))* ?\/?>//g' -e 's/<!--//g' -e 's/<https?:\/\/[a-zA-Z0-9./-]*>//g'
+ grep '<'
+	"coll-rendering_text": "စာရွက်စာတမ်းကို ပြင်ဆင်နေချိန်တွင် ကျေးဇူးပြု၍ စောင့်ဆိုင်းပါ။ \n\n လုပ်ငန်းစဉ်- <span id=\"renderingProgress\">$1 % <span id=\"renderingStatus\">$2 \n\n ဤစာမျက်နှာသည် စက္ကန့်အနည်းငယ်တိုင်း အလိုအလျောက် ပြန်လည်စတင်သင့်သည်။ သို့မဟုတ်ပါက သင့်ဘရောက်ဆာ၏ ပြန်လည်စတင်ခြင်း ခလုတ်ကို နှိပ်ပါ။",
+	"coll-rendering_failed_text": "စာရွက်စာတမ်းဖိုင် ပြင်ဆင်ခြင်း မအောင်မြင်ပါ။ \n\n <span id=\"renderingStatus\">$1",
+ echo 'HTML detected. Manual review required'
HTML detected. Manual review required
+ exit 1

If I understand correctly, class, title, lang, and some other attributes are allowed in <span>, but not id.

I'm not a security expert, but it looks to me like a common attribute that could be allowed.

Event Timeline

Change 999240 had a related patch set uploaded (by Amire80; author: Amire80):

[integration/config@master] jjb: [mediawiki-i18n-check-docker] Add "id" to allow list in i18n

https://gerrit.wikimedia.org/r/999240

Change 999240 merged by jenkins-bot:

[integration/config@master] jjb: [mediawiki-i18n-check-docker] Add "id" to allow list in i18n

https://gerrit.wikimedia.org/r/999240