Page MenuHomePhabricator

Application Security Review Request: Wikifunctions rich text (HTML) output
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project:
Wikifunctions allows user-written Functions to be embedded in pages through a wikitext parser function, and thus provide static content. This is currently limited to plain text (outputting a LiteralStringPFragment to Parsoid).

Description of how the tool will be used at WMF:
We wish to extend this feature to also be able to output HTML (outputting an HtmlPFragment to Parsoid). The content will only be used as HTML after passing through MediaWiki's Sanitizer.php (and thus Remex).

Dependencies

List dependencies, or upstream projects that this project relies on.

  • Parsoid
  • MediaWiki Sanitizer
  • Remex

Has this project been reviewed before?

Please link to tasks or wiki pages of previous reviews.

Working test environment

Please link or describe setup process for setting up a test environment.

Post-deployment

Name of team responsible for tool/project after deployment and primary contact.

Event Timeline

sbassett changed the task status from Open to In Progress.Jul 8 2025, 3:22 PM
sbassett claimed this task.
sbassett triaged this task as Medium priority.
sbassett moved this task from Upcoming Quarter Planning Queue to In Progress on the secscrum board.
sbassett added a project: user-sbassett.
sbassett moved this task from Backlog to In Progress on the user-sbassett board.

Hey all - just wanted to check in and see how the relevant code was progressing here. Thanks.

Hey all - just wanted to check in and see how the relevant code was progressing here. Thanks.

Hi Scott, sorry for the delay. The relevant code (T398987) is just landing now. I've added some very simple top-level instructions to the extension's README, but Geno has a more detailed document for using and testing the system.

Hi Scott, sorry for the delay. The relevant code (T398987) is just landing now. I've added some very simple top-level instructions to the extension's README, but Geno has a more detailed document for using and testing the system.

Ok, thanks. I'll probably start looking at this later this week or early next week.

Update: I am giving this an initial risk rating of low as WikifunctionsPFragmentSanitiserTokenHandler.php looks perfectly reasonable to me on its face. I do want to spend a little more time trying to break it, but I'm fairly certain I won't find any serious issues.

sbassett moved this task from Waiting to Our Part Is Done on the secscrum board.
sbassett moved this task from In Progress to Done on the user-sbassett board.

Sorry, the trigger re-opened this automatically when moving the task. Have removed the trigger.