Page MenuHomePhabricator

Add tartan namespace to allow-list
Open, Needs TriagePublicFeature

Description

Feature summary (what you would like to be able to do and where):

I would like to be able to upload SVG files with the namespace`"https://marnanel.org/tartan/2023"`.

This can be done by adding the namespace here:
https://phabricator.wikimedia.org/source/mediawiki/browse/master/includes/upload/UploadBase.php$1626

Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):

There are so many files in the Commons category "Tartan images that should use vector graphics" that I've been building a toolforge application to edit them:

https://adjustyoursett.toolforge.org

https://gitlab.wikimedia.org/toolforge-repos/adjustyoursett/

Here is my problem. I figured it would be a sensible plan to have the SVG files be machine-readable, so you could load a tartan SVG back into the tool and make changes. Therefore, I invented a tartan namespace. But then I discovered that Mediawiki blocks namespaces it doesn't know about.

It would be ''possible'' to go back and change this to a microformat, but I think using a separate namespace for annotation is closer to the spirit of XML.

This is the namespace spec:
https://gitlab.wikimedia.org/toolforge-repos/adjustyoursett/-/blob/main/docs/namespace.md

Benefits (why should this be implemented?):

It means we can modify tartan images directly, which allows people to reuse them more effectively.

Details

Related Changes in Gerrit:

Event Timeline

Fixing this up within the SVG namespace would be easy with data-* attributes-- but those only exist in SVG 2.0, which isn't commonly implemented. I could work around the problem by storing the palette details in the Inkscape namespace, but that's getting horribly hacky.

Here's a patch:

The real answer would be the one given at the top of that function:

/**
 * @todo Replace this with a allow list filter!

but I don't know the codebase well enough atm.

Change #1119253 had a related patch set uploaded (by Gerrit Patch Uploader; author: Gerrit Patch Uploader):

[mediawiki/core@master] Add tartan namespace to allowlist

https://gerrit.wikimedia.org/r/1119253

I've copied the patch into Gerrit for review.

See https://www.mediawiki.org/wiki/Gerrit/Tutorial for the correct way to submit patches for future reference.

I've copied the patch into Gerrit for review.

See https://www.mediawiki.org/wiki/Gerrit/Tutorial for the correct way to submit patches for future reference.

Thank you!

I wonder how other applications do this, e.g. Illustrator? Do they all use user-defined namespaces?

I wonder how other applications do this, e.g. Illustrator? Do they all use user-defined namespaces?

Yes-- http://ns.adobe.com/illustrator/1.0/ in your example. They're allow-listed explicitly.

The current allow-list was generated by scraping the existing files and seeing what namespaces they used at the time it was introduced.

Is there a way to merge this with T386271?

I have created a new patch which puts the allow list into the Mediawiki namespace, which belongs there. I would like to close this issue in favour of that one, because that one subsumes this issue's functionality,. How can I do that?

Phabricator does support a merge feature, but I suspect it's going to be much easier to get the one-line patch here code reviewed than it is for someone to write a patch, think through the conceptual issues with allowing wiki-admins to configure it, be confident enough to +2 the patch, etc. so I would leave this open.

For example: the original point of this was to stop XSS attacks so should editing the message be restricted to interface admins?