Top-level menu entries from MediaWiki:Sidebar are not properly escaped in the MediaWiki-skins-Foreground skin, resulting in classic stored XSS. The output of Sanitizer::escapeIdForAttribute is not HTML-safe, but the skin incorrectly assumes it is.
Minimal test case:
- As an (interface) administrator or other similarly privileged (editinterface) user, create a top level menu entry "named" '><script>alert('XSS')</script><' in MediaWiki:Sidebar (note that the payload is slightly different than the ones in T361448, T361449, T361450 given that Foreground uses single quotes for the element attributes, not double)
- Load a page with the Foreground skin
Expected result:
No alert.
Actual result:
The alertruns.
Proposed & tested patch:
diff --git a/includes/ForegroundTemplate.php b/includes/ForegroundTemplate.php index 429f362..5eac8c6 100644 --- a/includes/ForegroundTemplate.php +++ b/includes/ForegroundTemplate.php @@ -106,7 +106,7 @@ class ForegroundTemplate extends BaseTemplate { <ul id="top-bar-left" class="left"> <li class="divider show-for-small"></li> <?php foreach ( $this->getSidebar() as $boxName => $box ) { if ( ( $box['header'] != wfMessage( 'toolbox' )->text() ) ) { ?> - <li class="has-dropdown active" id='<?php echo Sanitizer::escapeIdForAttribute( $box['id'] ) ?>'<?php echo Linker::tooltip( $box['id'] ) ?>> + <li class="has-dropdown active" id='<?php echo htmlspecialchars( Sanitizer::escapeIdForAttribute( $box['id'] ), ENT_QUOTES ) ?>'<?php echo Linker::tooltip( $box['id'] ) ?>> <a href="#"><?php echo htmlspecialchars( $box['header'] ); ?></a> <?php if ( is_array( $box['content'] ) ) { ?> <ul class="dropdown">