The MintyDocs extension is vulnerable to stored XSS in several ways.

Stored XSS through parser functions

mintydocs_topic

1. Make sure Show preview without reloading the page is enabled in your preferences
2. Create a topic page and insert {{#mintydocs_topic:display name=<script>alert("Topic XSS")</script>}} into the edit box
3. Click "Show preview"

The display title is set to the value of the "display name" parameter without any sanitization: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsParserFunctions.php#L279
According to https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Parser_1_1ParserOutput.html#a926241e270866eb52b06047d978f7dc8, the setDisplayTitle function expects safe HTML.

mintydocs_manual (1)

1. Make sure Show preview without reloading the page is enabled in your preferences
2. Create a manual page and insert {{#mintydocs_manual:display name=<script>alert("Manual XSS 1")</script>}} into the edit box
3. Click "Show preview"

The display title is set to the value of the "display name" parameter without any sanitization: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsParserFunctions.php#L219
According to https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Parser_1_1ParserOutput.html#a926241e270866eb52b06047d978f7dc8, the setDisplayTitle function expects safe HTML.

mintydocs_manual (2)

1. Create a manual page with the content {{#mintydocs_manual:display name=<script>alert("Manual XSS 2")</script>}}
2. Go to a topic page that is a subpage of this manual page

The display name (defined via the "display name" parameter, not the one built into MW) is inserted into raw HTML without sanitization: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsTopic.php#L161

mintydocs_version

1. Create a version page with the content {{#mintydocs_version: manuals list=<script>alert("version xss")</script>}}
2. Visit the page

The content of the manuals list parameter is inserted into raw HTML without sanitization: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsVersion.php#L60

Stored XSS through system messages

mintydocs-topic-desc

1. Make sure $wgUseXssLanguage is set to true
2. Go to a topic page
3. Append ?uselang=x-xss to the end of the URL

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsTopic.php#L99

mintydocs-topic-otherversions

1. Make sure $wgUseXssLanguage is set to true
2. Go to a topic page that exists in multiple versions
3. Append ?uselang=x-xss to the end of the URL

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsTopic.php#L105

mintydocs-manual-desc

1. Make sure $wgUseXssLanguage is set to true
2. Go to a manual page
3. Append ?uselang=x-xss to the end of the URL

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsManual.php#L28

mintydocs-manual-otherversions

1. Make sure $wgUseXssLanguage is set to true
2. Go to a manual page that exists in multiple versions
3. Append ?uselang=x-xss to the end of the URL

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsManual.php#L34

mintydocs-version-desc

1. Make sure $wgUseXssLanguage is set to true
2. Go to a version page
3. Append ?uselang=x-xss to the end of the URL

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsVersion.php#L43

mintydocs-product-versionlist

1. Make sure $wgUseXssLanguage is set to true
2. Go to a product page that has at least one version
3. Append ?uselang=x-xss to the end of the URL

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/MintyDocsProduct.php#L80

mintydocs-publish-success

1. Assure there are multiple drafts in your wiki
2. Make sure $wgUseXssLanguage is set to true
3. Go to the publish special page (Special:MintyDocsPublish) with the uselang parameter set to x-xss and publish multiple drafts at once

Cause: https://github.com/wikimedia/mediawiki-extensions-MintyDocs/blob/f3427df9bd0d421d3af99b052cf471f8af7817c8/includes/specials/MintyDocsPublish.php#L392

Additional information

• MW: 1.45.0-alpha (4a86955)
• PHP: 8.3.14 (fpm-fcgi)
• MintyDocs: 1.4 (f3427df)
• Browser: Firefox 138.0.4 (64-bit) on Fedora Linux 42

You might need to apply the following changes to get the extension working on >1.44:

diff --git a/includes/MintyDocsTopic.php b/includes/MintyDocsTopic.php
index 1527c2d..e4bf60f 100644
--- a/includes/MintyDocsTopic.php
+++ b/includes/MintyDocsTopic.php
@@ -1,5 +1,6 @@
 <?php
 
+use MediaWiki\Html\Html;
 use MediaWiki\MediaWikiServices;
 use MediaWiki\Title\Title;
 
diff --git a/includes/specials/MintyDocsPublish.php b/includes/specials/MintyDocsPublish.php
index 70b4068..e0486d1 100644
--- a/includes/specials/MintyDocsPublish.php
+++ b/includes/specials/MintyDocsPublish.php
@@ -1,6 +1,7 @@
 <?php
 
 use MediaWiki\Html\Html;
+use MediaWiki\Html\ListToggle;
 use MediaWiki\MediaWikiServices;
 use MediaWiki\Title\Title;