Thanks for raising this. I have made a quick patch, could someone give a code review?

diff --git a/includes/FeaturedFeedChannel.php b/includes/FeaturedFeedChannel.php
index 8cedb04..9be9505 100644
--- a/includes/FeaturedFeedChannel.php
+++ b/includes/FeaturedFeedChannel.php
@@ -147,9 +147,9 @@ class FeaturedFeedChannel {
 		if ( $this->title !== false ) {
 			return;
 		}
-		$this->title = $this->msg( $this->options['title'] )->text();
-		$this->shortTitle = $this->msg( $this->options['short-title'] )->text();
-		$this->description = $this->msg( $this->options['description'] )->text();
+		$this->title = $this->msg( $this->options['title'] )->escaped();
+		$this->shortTitle = $this->msg( $this->options['short-title'] )->escaped();
+		$this->description = $this->msg( $this->options['description'] )->escaped();
 		$pageMsg = $this->msg( $this->options['page'] )->params( $this->languageCode );
 		if ( $pageMsg->isDisabled() ) {
 			// fall back manually, messages can be existent but empty
-- 

In T392279#10767003, @Jly wrote:

Thanks for raising this. I have made a quick patch, could someone give a code review?

T392279.patch1 KBDownload

CR+1, untested but LGTM. Often times we push these simple text -> escaped patches through gerrit, but since ext:FeaturedFeeds is Wikimedia-deployed, it should likely be security-deployed this Monday (2025-04-28).

Are you sure all of those should be escaped? Peesumably only the fields that are html embedded in xml should be escaped like this, and not the fields that are considered plain text.

In T392279#10769278, @Bawolff wrote:

Are you sure all of those should be escaped? Peesumably only the fields that are html embedded in xml should be escaped like this, and not the fields that are considered plain text.

Per https://www.mediawiki.org/wiki/Extension:FeaturedFeeds/WMF_deployment#Message_names, the fields in question are all defined by system messages, no? If we're going to care about the case where a bad browser or feed reader is rendering potentially dangerous html in an XML feed, then I think we'd want to escape these. Most of the time escaped() should just be a noop, as every example message I'm seeing (at least on enwiki) is a simple string without any potentially dangerous chars. I guess this could unintentionally escape ', " and &, since in addition to calling transformText() as text() does, escaped() also passes the data through htmlspecialchars() and Sanitizer::escapeCombiningChar(). But that's probably just a trade-off of having additional defenses against potentially malicious messages.

The atom spec does define some fields as escaped html embedded in xml, so its not just about bad feed readers - compliant readers do render some of these fields as html (but not others), although one hopes they would skip dangerous stuff.

I'm wondering if we should just push this patch publicly through gerrit? I feel like the XSS possibilities are fairly low-risk (message values, bad feed client, etc.) and it might benefit from public discussion as to whether or not this is the best approach. Thoughts?

I should say that the patch only does title, shortTitle and description. It does not affect the <entry> ones which accepts type="html". I'm open to pushing this publicly as I think it's a low-risk issue that applies to feed clients vs a vulnerability with our systems itself.

In T392279#10811557, @Jly wrote:

I should say that the patch only does title, shortTitle and description. It does not affect the <entry> ones which accepts type="html". I'm open to pushing this publicly as I think it's a low-risk issue that applies to feed clients vs a vulnerability with our systems itself.

Any objections to pushing this publicly through gerrit as a more low-risk patch? To get some public CR and see if there are any compelling reasons not to do this?

Change #1149742 had a related patch set uploaded (by Jly; author: Jly):

[mediawiki/extensions/FeaturedFeeds@master] SECURITY: Escape i18n message in action FeaturedFeedChannel

https://gerrit.wikimedia.org/r/1149742

Change #1149742 merged by jenkins-bot:

[mediawiki/extensions/FeaturedFeeds@master] SECURITY: Escape i18n message in action FeaturedFeedChannel

https://gerrit.wikimedia.org/r/1149742