Quick patch; think this gets all of it:

This will break the usability testing, but oh well.

In T404392#11174463, @Jdforrester-WMF wrote:

Quick patch; think this gets all of it:

T404392.patch7 KBDownload

This will break the usability testing, but oh well.

CR+2, most of this make sense to me: mustache/vue-style escapes around the getErrorMessage( error ) calls and then a i18n parse call.

This fixed the bits I noticed with malicious error labels, but not the reported issue with malicious error arguments; I've now got an improved version:

OK, third time's the charm:

We'll have to consider in the morning if there are other abuse routes I've missed, and how we can fix the system to provide the functionality wanted without this issue, but for tonight I think we're done.

In T404392#11174736, @Jdforrester-WMF wrote:

OK, third time's the charm:

T404392-2.patch15 KBDownload

Thanks! I can confirm that the example payload within the task description can no longer be reproduced in production. Let's plan to follow up tomorrow.

@Jdforrester-WMF After this patch lands publicly in Gerrit, please consider replacing the <!-- eslint-disable vue/no-v-html --> comments that it does leave in / add in to use eslint-disable-next-line instead. Otherwise you could still be missing uses of v-html that occur anywhere in the same file below the first one.

For the record, @Dv103 has also disclosed some details about this task publicly (before it was even fixed – timestamps are in UTC+2):

Fixed another related error argument label vulnerability on top of James' latest version. I've checked injection on error string arguments, but also error labels and error argument labels. This should do it:

In T404392#11174833, @Catrope wrote:

@Jdforrester-WMF After this patch lands publicly in Gerrit, please consider replacing the <!-- eslint-disable vue/no-v-html --> comments that it does leave in / add in to use eslint-disable-next-line instead. Otherwise you could still be missing uses of v-html that occur anywhere in the same file below the first one.

Yeah, the multi-line Vue code breaks eslint-disable-next-line directives; will add the re-enables in.

In T404392#11175495, @Lucas_Werkmeister_WMDE wrote:

For the record, @Dv103 has also disclosed some details about this task publicly (before it was even fixed – timestamps are in UTC+2):

Eurgh, thanks for flagging. @Dv103, please don't discuss private tasks publicly.

Given that, and the fact that there are probably very few other (non-dev) WikiLambda installs around, it’s probably best to publish the task+fix relatively soon? (I.e. without waiting for the next full security release, at least IMHO.)

Yes, that's the plan.

In T404392#11175744, @gengh wrote:

Fixed another related error argument label vulnerability on top of James' latest version. I've checked injection on error string arguments, but also error labels and error argument labels. This should do it:

T404392-3.patch17 KBDownload

Thanks! Very slight tweak to add the eslint-disable fixes Roan suggested, and split into a second git commit on top of the deployed one, for easier management.

{F66017626}

Will deploy now.

OK, I believe we're now good to push the patches to gerrit and land into master. @sbassett, can you confirm that's OK?

In T404392#11175953, @Jdforrester-WMF wrote:

OK, I believe we're now good to push the patches to gerrit and land into master. @sbassett, can you confirm that's OK?

LGTM, thanks! I've verified the patches appear correct on deployment:

$ ls /srv/patches/1.45.0-wmf.18/extensions/WikiLambda/
01-T404392.patch  02-T404392.patch
...
$ pwd
/srv/mediawiki-staging/php-1.45.0-wmf.18/extensions/WikiLambda
...
$  git log --graph --decorate --oneline -n2
* 7753571d (HEAD) SECURITY: Do not let error type labels or arguments return HTML either
* 6b5ca6bc SECURITY: Do not let getErrorMessages() etc. return HTML ever, at least for now

And we're also now tracking the patches under T276237 and T397776.

Update - thanks, @Jdforrester-WMF et al for getting these patches backported in gerrit and dropped from deployment!

1. https://gerrit.wikimedia.org/r/q/I76ba6168e9723230f95f5a2785df90f9327a0148
2. https://gerrit.wikimedia.org/r/q/I996fa2f9ec5112978296ad8f357176123f8f692b