https://meta.wikimedia.org/wiki/Community_Wishlist/W309 shows up on https://meta.wikimedia.org/wiki/Community_Wishlist/Wishes as "Make subreferencing work with inline refs and {{reflist}} "

QA notes

What we're looking for here are two things (combines T407961 which I didn't send to QA because it's been fixed in prod for a while):

• XSS vulnerabilities in wish titles i.e. <script>alert('foo');</script> particularly when viewing a wish with realtime preview and in our own wish-index table
• What you type in the tile is (generally) what should be seen. I.e. <b>{{reflist}}</b> [[wish]] search test <gallery></gallery> should appear the same when viewing the wish by any means, as opposed to the <b> tags and the [[link]] being rendered, etc.
  • An expected exception are <span> tags with either or both a lang or dir attribute. These are rendered and preserved because we can't differ them from <span> tags added by Extension:Translate.

Further details (may not need to be QA'd directly):

• The saved wikitext should be escaped when necessary. The previous example would get saved as <b>&#123;&#123;reflist&#125;&#125;</b> &#91;&#91;wish&#93;&#93; search test &lt;gallery&gt;&lt;/gallery&gt;
  • Just mentioning this for completeness sake. There's no need to manually verify the HTML escaping is correct, as verifying it loads as expected in Special:WishlistIntake should cover it.
• Fuzzy translations should be rendered
  • Create or use an existing wish that's (a) marked for translation and (b) has the title translated in at least one other language
  • Edit the wish and change the tile
  • Re-mark for translation
  • Browse to the translation subpage of the other language, and the title should be highlighted as the the translation is outdated

Derived Requirement

Ensure that wish titles on the Community Wishlist display user-entered wikitext literally across all viewing contexts (including realtime preview, wish pages, and the wish-index table), without rendering HTML or wikitext, except for <span> tags containing lang or dir attributes, which should be preserved. Prevent execution of any scripted or injected HTML. When a translated wish title becomes outdated due to edits, its translation subpage should correctly indicate that it is fuzzy/outdated.

Test Steps

Test Case 1: Validate Literal Wikitext Display, XSS Protection, and Outdated Translation Highlighting

1. Navigate to Special:'WishlistIntake' and create a new wish (or edit an existing one).
2. In the title field, enter wikitext such as <b>{{reflist}}</b> [[wish]] search test <gallery></gallery>.
3. Save the wish and view it on: • its wish page • the Community_Wishlist/Wishes index • realtime preview
4. Insert an XSS test string in the title such as <script>alert('foo');</script> and save.
5. Create or use an existing translated wish that has at least one other language translation.
6. Edit the wish title, save, and re-mark it for translation.
7. Navigate to the translated language subpage.
8. ✅❓❌⬜ AC1: Confirm that the title displays *literally* without rendering <b>, [[link]], <gallery>, or other wikitext/HTML in any viewing location.
9. ✅❓❌⬜ AC2: Confirm that <span> tags containing lang and/or dir attributes are preserved and rendered.
10. ✅❓❌⬜ AC3: Confirm that no script or injected HTML (e.g., <script>alert('foo');</script>) executes anywhere, including realtime preview and the wish-index table.

QA Results - Meta Beta