When emitting a news feed item for the creation of a wikitext page, the newpage message text is directly included in the output without being escaped:
$diffText = Html::rawElement( 'p', [], Html::rawElement( 'b', [], wfMessage( 'newpage' )->text() ) );
Tested locally with &uselang=x-xss:
<summary type="html"> <p>Created blank page</p> <p><b><script>alert('newpage')</script>"><script>alert('newpage')</script><x y="()</b></p><div></div> </summary>
I’m not sure what the impact of this is – I hesitate to call it “XSS” because I don’t think this would usually be shown in the user’s normal browsing context, where script execution is really problematic. But we should still fix it; at a minimum, I assume this allows a wiki admin to make the feed output confusing and/or malformed.
This was actually noticed a few years ago. When @DannyS712 ported this code from bare string manipulation to the Html class (Gerrit change) –
- $diffText = '<p><b>' . wfMessage( 'newpage' )->text() . '</b></p>' . - '<div>' . $html . '</div>'; + $diffText = Html::rawElement( + 'p', + [], + Html::rawElement( 'b', [], wfMessage( 'newpage' )->text() ) + );
@thiemowmde commented:
This allows HTML injections, I believe. Let's make sure we fix this (in another patch).
And then, as far as I can tell, nothing happened beyond that. :|