Summary
The CheckUser extension has Special:CheckUser which is currently vulnerable to i18n XSS (through checking with the x-xss language). These XSS vectors should be fixed.
Background
- The x-xss language allows finding messages which are not properly escaped in MediaWiki interfaces
- The CheckUser extension has Special:CheckUser for checking users to see if they have performed abuse through sockpuppetry
- When using the x-xss language on Special:CheckUser after submitting the form, there are several popup alerts that indicate the CheckUser is not properly escaping these messages
- The messages that is vulnerable is rev-deleted-user
Technical notes
To reproduce:
- Set $wgUseXssLanguage to be true
- Create a user which is then suppressed
- Load Special:CheckUser
- Modify the HTML of the POST form to include a hidden input field that sets uselang to x-xss in the POST request (e.g. add <input type="hidden" value="x-xss" name="uselang"> somewhere inside the <form> element)
- This is needed because we can't add the uselang=x-xss query param to the URL as the checks use POST requests
- Submit the form
Screenshots
Acceptance criteria
- The CheckUser Special:CheckUser page is no longer vulnerable to i18n XSS