| Daimona | |
| May 29 2025, 9:14 PM |
| F60824835: T395622.patch | |
| May 29 2025, 9:26 PM |
The special pages in question have 3 instances of HTMLForm's validation-callback where an error message is returned using Message::text():
But when returning a string from validation-callback, the string is displayed as-is, so this is vulnerable to XSS-via-i18n. Returning the whole Message object would be enough to fix this.
As usual, I'm assuming this to be low-risk since it's via i18n, but still, adding the patch here:
Note that the one for event types has a public fix in gerrit with a broader refactoring of that code. This was also introduced recently (T386273 / r1144701) and is behind a feature flag not enabled anywhere. Hence I excluded this from the security patch (also to avoid conflicts).
The patch above will need backporting to REL1_42, REL1_43, and REL1_44 (not 1.39 as the Message::text() calls were introduced in r889129 and r930213, with the oldest affected MW version being 1.40).
Once this is made public, I'd like to make a follow-up task to have phan-taint-check-plugin catch these (writing it here so I don't forget).
+1 to this patch and going to get this out in today's security deploy. Adding support to the phan-taint-check-plugin for these issues is a great idea and I'll ping about a follow up task in case that doesn't happen.
Change #1165949 had a related patch set uploaded (by Jly; author: Jly):
[mediawiki/extensions/CampaignEvents@master] SECURITY: do not return result of Message::text() in validation-callback
Change #1165950 had a related patch set uploaded (by Jly; author: Jly):
[mediawiki/extensions/CampaignEvents@REL1_44] SECURITY: do not return result of Message::text() in validation-callback
Change #1165951 had a related patch set uploaded (by Jly; author: Jly):
[mediawiki/extensions/CampaignEvents@REL1_43] SECURITY: do not return result of Message::text() in validation-callback
Change #1165952 had a related patch set uploaded (by Jly; author: Jly):
[mediawiki/extensions/CampaignEvents@REL1_42] SECURITY: do not return result of Message::text() in validation-callback
Change #1165950 merged by jenkins-bot:
[mediawiki/extensions/CampaignEvents@REL1_44] SECURITY: do not return result of Message::text() in validation-callback
Change #1165951 merged by jenkins-bot:
[mediawiki/extensions/CampaignEvents@REL1_43] SECURITY: do not return result of Message::text() in validation-callback
Change #1165949 merged by jenkins-bot:
[mediawiki/extensions/CampaignEvents@master] SECURITY: do not return result of Message::text() in validation-callback
@Jly noting that the patch for 1.42 was not merged. 1.42 went EOL a few days ago, though, so maybe the intent was to abandon the patch? Also wondering, can this task can be made public now?
Eh, this should technically be a part of the final security release for 1.42. So we (@Jly et al) should work to resolve those conflicts and get that change set merged.
Change #1165952 merged by Daimona Eaytoy:
[mediawiki/extensions/CampaignEvents@REL1_42] SECURITY: do not return result of Message::text() in validation-callback