Page MenuHomePhabricator

CVE-2025-32072: HTML injection in feed output from i18n message
Closed, ResolvedPublicSecurity

Description

When emitting a news feed item for the creation of a wikitext page, the newpage message text is directly included in the output without being escaped:

FeedUtils::formatDiffRow2()
				$diffText = Html::rawElement(
					'p',
					[],
					Html::rawElement( 'b', [], wfMessage( 'newpage' )->text() )
				);

Tested locally with &uselang=x-xss:

<summary type="html">
<p>Created blank page</p> <p><b><script>alert('newpage')</script>"><script>alert('newpage')</script><x y="()</b></p><div></div>
</summary>

I’m not sure what the impact of this is – I hesitate to call it “XSS” because I don’t think this would usually be shown in the user’s normal browsing context, where script execution is really problematic. But we should still fix it; at a minimum, I assume this allows a wiki admin to make the feed output confusing and/or malformed.

This was actually noticed a few years ago. When @DannyS712 ported this code from bare string manipulation to the Html class (Gerrit change) –

-				$diffText = '<p><b>' . wfMessage( 'newpage' )->text() . '</b></p>' .
-					'<div>' . $html . '</div>';
+				$diffText = Html::rawElement(
+					'p',
+					[],
+					Html::rawElement( 'b', [], wfMessage( 'newpage' )->text() )
+				);

@thiemowmde commented:

This allows HTML injections, I believe. Let's make sure we fix this (in another patch).

And then, as far as I can tell, nothing happened beyond that. :|

Event Timeline

Suggested fix:

diff --git a/includes/Feed/FeedUtils.php b/includes/Feed/FeedUtils.php
index c180da2ff5..4896c5ca28 100644
--- a/includes/Feed/FeedUtils.php
+++ b/includes/Feed/FeedUtils.php
@@ -254 +254 @@ public static function formatDiffRow2(
-					Html::rawElement( 'b', [], wfMessage( 'newpage' )->text() )
+					Html::element( 'b', [], wfMessage( 'newpage' )->text() )

(The newpage message doesn’t appear to contain any markup in any of the translations tracked in MediaWiki core.)

That's why I usually create such follow-up patches right away. 😅️ I can't tell why we forgot to do that back then. Sure thing, let's do that.

I agree this is hard, if not impossible to exploit and probably not critical.

Suggested fix:

CR+1, this should just go through gerrit and then we can add it to the upcoming supplemental release (T382326).

Change #1120134 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/core@master] Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1120134

Change #1120134 merged by jenkins-bot:

[mediawiki/core@master] Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1120134

Mstyles renamed this task from HTML injection in feed output from i18n message to CVE-2025-32072: HTML injection in feed output from i18n message.Apr 11 2025, 5:04 PM
Mstyles closed this task as Resolved.
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".

I'm a bit confused what exactly happened here. As far as I can tell this is a bug in core. Why was this not backported to supported branches? Why was it included in the announcement for non-bundled extensions/skins instead of the main point release announcement?

I'm a bit confused what exactly happened here. As far as I can tell this is a bug in core. Why was this not backported to supported branches? Why was it included in the announcement for non-bundled extensions/skins instead of the main point release announcement?

It was deemed low-risk, so we just pushed it through gerrit. It was accidentally included in the recent supplemental release; you're correct that it should have been a part of the core release. That's also the reason backports to supported release branches weren't performed, though we can do those now.

Change #1137346 had a related patch set uploaded (by SBassett; author: Lucas Werkmeister (WMDE)):

[mediawiki/core@REL1_43] Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137346

Change #1137347 had a related patch set uploaded (by SBassett; author: Lucas Werkmeister (WMDE)):

[mediawiki/core@REL1_42] Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137347

Change #1137348 had a related patch set uploaded (by SBassett; author: Lucas Werkmeister (WMDE)):

[mediawiki/core@REL1_39] Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137348

Change #1137347 merged by jenkins-bot:

[mediawiki/core@REL1_42] SECURITY: Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137347

Change #1137346 merged by jenkins-bot:

[mediawiki/core@REL1_43] SECURITY: Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137346

Change #1137348 abandoned by SBassett:

[mediawiki/core@REL1_39] SECURITY: Escape newpage message in FeedUtils

Reason:

See above comments

https://gerrit.wikimedia.org/r/1137348

Change #1137348 restored by SBassett:

[mediawiki/core@REL1_39] SECURITY: Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137348

Change #1137348 merged by jenkins-bot:

[mediawiki/core@REL1_39] SECURITY: Escape newpage message in FeedUtils

https://gerrit.wikimedia.org/r/1137348

Reedy added a parent task: Restricted Task.Jun 24 2025, 8:31 PM