| jhsoby | |
| Mar 20 2024, 9:30 AM |
| F43363138: T360504-2.patch | |
| Mar 25 2024, 8:08 PM |
| F42828115: T360504.patch | |
| Mar 20 2024, 9:33 AM |
Discovered with $wgUseXssLanguage.
To reproduce:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Change message formatting in 'tux-nojs' message | mediawiki/extensions/Translate | master | +5 -5 |
Seems to have been introduced in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Translate/+/772056
Maybe ->escaped() would be better than ->parse() to match the original behavior.
Wouldn't parsing be better if it's possible? I can imagine some languages may have a convention of putting "foreign terms" like JavaScript in italics, for instance.
Looking through the Message, MessageCache and Parser code within core, parse and escaped are very similar, though escaped does add the extra htmlspecialchars call, which is likely safer (and shouldn't affect strings like "JavaScript") and maybe a bit better at discouraging the use of html in message strings which, from a security perspective, we'd like to actively discourage unless critically necessary.
I updated the existing patch to used escaped instead of parsed. If we agree to move forward with this, I can upload this on gerrit so that we can address this issue faster.
Change #1014537 had a related patch set uploaded (by Jon Harald Søby; author: Jon Harald Søby):
[mediawiki/extensions/Translate@master] Change message formatting in 'tux-nojs' message
Change #1014537 merged by jenkins-bot:
[mediawiki/extensions/Translate@master] Change message formatting in 'tux-nojs' message