Page MenuHomePhabricator

The data HTML attribute name can't include the underscore sign anymore
Open, Needs TriagePublicBUG REPORT

Description

Hi. Very weird situation. I have a code, hundreds of KB, works for years, and this morning there is suddenly a big mess. It took a lot of time to debug it, but here is the minimal example I created.

  1. Open a sandbox.
  2. Put the code
<div data-brbnk="3445">abc</div>
<div data-br_nk="3445">abc</div>
  1. Open a preview.
  2. Click F12 to open the code Inspector.
  3. Find the relevant HTML part in the code.
  4. Expected:
<div data-brbnk="3445">abc</div>
<div data-br_nk="3445">abc</div>

And this was there yesterday for sure.

  1. Got:
<div data-brbnk="3445">abc</div>
<div>abc</div>

There isn't something relevant in the console. Happens on different devices, OSs, browsers, and logged out. I've checked other characters. Looks like the dot doesn't sometimes work too, and the rest do work. Was there any new HTML sanitizer deployed this week? Because if wasn't, it seems to be a problem. I even checked if there isn't any new HTML standard published, to be sure. What is more weird, it's nondeterministic. Sometimes, very rarely, I got the right answer, without any visible reason. So, I can't prove you it happens if you can't reproduce it. I can give you the page I mentioned, when it always happens, but I'm pretty sure it's too complicated to debug this.
Thank you.

image.png (783×1 px, 90 KB)

image.png (775×1 px, 87 KB)

Event Timeline

Hello. There is currently a security patch within Wikimedia production which is the cause of these issues, which is all we can really state publicly at this time.

Hello. There is currently a security patch within Wikimedia production which is the cause of these issues, which is all we can really state publicly at this time.

I see. Thank you.

A problem that may be related to this issue is discussed at en.wiki (permalink). An editor there has implicated the aforementioned security patch.

Is the problem described at en.wiki associated with the security patch? Is there a patch for the patch?

Is the problem described at en.wiki associated with the security patch?

Yes.

Is there a patch for the patch?

No, at least not in Wikimedia production.

I've just deployed an updated patch that should fix the issues discussed here. Please let me know if the issues persist.