Background
Generally MediaWiki uses the threat model where we do not want users to be able to embed content that loads external resources. This is to prevent privacy leaks from web bugs, potentially leaking IP addresses or current page, etc
MobileFrontend has a feature where spans with class lasy-image-placeholder (e.g. <span class="lazy-image-placeholder" data-width="100" data-height="100" data-src="https://example.com"> </span> ) get replaced with image tags based on data attributes. User's can construct these allowing them to bypass some sanitization (enough to make an arbitrary GET request, not enough for XSS).
Which when viewed will send the current user's name to example.com.
Longer term fix would be CSP
See also the slightly related task T147995
User story
As an editor I want to view Wikipedia safely
Requirements
- Using data-mw-src (and so on for the other attributes) instead of data-src, as the mediawiki sanitizer forbids using attributes starting with data-mw.
- For caching purposes, the frontend must support both initially to avoid image display breaking.
BDD
Feature: Prevent cross-origin data leaks via MobileFrontend lazy load images
Scenario: No references to data-src or data-srcset in page source
Given a user visits the mobile version of an article
When they view the page source
Then there should be no references to data-src or data-srcset
Scenario: No broken images in editor preview for user-inserted lazy image placeholders
Given a user views a preview of an article containing a lazy-image-placeholder span
When the editor loads the preview
Then no broken image should display above the editor fieldTest Steps
Test Case 1: Verify no references to data-src or data-srcset in page source
- Visit http://en.m.wikipedia.org/wiki/Rabbits.
- Open the developer tools and view the page source.
- AC1: Confirm that there are no references to data-src or data-srcset in the source code.
Test Case 2: Verify no broken images in the editor preview
- Visit this test page.
- Observe the editor field in preview mode.
- AC2: Confirm that no broken image appears above the editor field.
QA Results - Prod
| AC | Status | Details |
|---|---|---|
| 1 | ✅ | T366402#10585799 |
| 2 | ✅ | T366402#10585799 |
Design
- Add mockups and design requirements
Acceptance criteria
- Add acceptance criteria
Communication criteria - does this need an announcement or discussion?
- Add communication criteria
Rollback plan
- What is the rollback plan in production for this task if something goes wrong?
This task was created by Version 1.3.0 of the Web team task template using phabulous
