Page MenuHomePhabricator

CVE-2026-58520: UrlShortener defaults to ineffective validation open to third-party redirects
Closed, ResolvedPublicSecurity

Description

Extension:UrlShortener has a default setting of UrlShortenerAllowedDomains: false, which is meant to translate to allowing only the current domain. Given that $wgUrlShortenerAllowedDomains takes a regex, the code defaults to generating a regex on-demand derived from wgServer, like so:

Gerrit: UrlShortenerUtils.php#422

	public function getAllowedDomainsRegex(): string {
		$allowedDomains = $this->config->get( 'UrlShortenerAllowedDomains' );
		if ( $allowedDomains === false ) 
			$serverParts = $this->urlUtils->parse( $this->config->get( MainConfigNames::Server ) ) ?? [];
			return preg_quote( $serverParts['host'], '/' );
		}
		return implode( '|', array_map(
			static function ( $item ) {
				return '^' . $item . '$';
			},
			$allowedDomains
		) );
	}

While an array of custom regexes is correctly given a start and end anchor (caret ^, and dollar $), the default is not.

It seems this bug has been there since the first version of this mechanism was committed in 2014 (change 139579).

Problem

Proposed solution

Applying a start/end anchor is simple, but would break www and other subdomains. I suggest as a default, we do the same that we do in production, which allows optional subdomains:

^(.*\.)?wikipedia\.org$

This would make the security patch not a breaking change, and aligns it with future direction of T418430, where Proposal 1 would produce the same behavior.

Event Timeline

DAlangi_WMF changed the task status from Open to In Progress.Mar 3 2026, 9:47 AM

Attached is a patch for review.

sbassett triaged this task as Medium priority.EditedMar 18 2026, 2:28 PM
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed Risk Rating from N/A to Medium.
sbassett changed Author Affiliation from Wikimedia Communities to WMF Product.
sbassett subscribed.

Attached is a patch for review.

Looks like this file attachment needs to have its visibility adjusted a bit. I can't view it. To match the permissions of this security task, you'd probably want to use a custom policy to make it visible to the file/paste authors, file/paste subscribers and acl*security.

Done @sbassett. Thanks for the link @Aklapper!

I had initially just used "Can view" for subscriber and didn't add you. But I've used the custom policy now.

Updated the patch to fix PHPUnit tests.

Updated the patch to fix PHPUnit tests.

CR+1, this seems reasonable to me and thanks for the tests. Let's plan to get this deployed during this Monday's (2026-04-27) security deployment window.

CR+1, this seems reasonable to me and thanks for the tests. Let's plan to get this deployed during this Monday's (2026-04-27) security deployment window.

@sbassett, this doesn't affect WMF production, so it doesn't need an explicit security deployment, but it does need to go out in the next security release for the UrlShortener extension.

When is the next security release, and is there anything we need to do before that wrt the patch?

@sbassett, this doesn't affect WMF production, so it doesn't need an explicit security deployment, but it does need to go out in the next security release for the UrlShortener extension.

When is the next security release, and is there anything we need to do before that wrt the patch?

Ah, ok. Security releases typically happen around the end of each quarter. So the next one (T421263) should be released at the end of June 2026. Since UrlShortener isn't bundled, we can track this issue under the supplemental release (T421273).

Change #1306769 had a related patch set uploaded (by Mstyles; author: Derick Alangi):

[mediawiki/extensions/UrlShortener@master] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1306769

Change #1306770 had a related patch set uploaded (by Mstyles; author: Derick Alangi):

[mediawiki/extensions/UrlShortener@REL1_46] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1306770

@Krinkle I went ahead and uploaded this patch to gerrit. Could you please +2 when you get a chance?

Change #1306770 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@REL1_46] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1306770

Change #1306769 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@master] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1306769

Mstyles renamed this task from UrlShortener defaults to ineffective validation open to third-party redirects to CVE-2026-58520: UrlShortener defaults to ineffective validation open to third-party redirects.Jul 1 2026, 5:14 PM
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".

Change #1307222 had a related patch set uploaded (by SBassett; author: Derick Alangi):

[mediawiki/extensions/UrlShortener@REL1_45] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1307222

Change #1307225 had a related patch set uploaded (by SBassett; author: Derick Alangi):

[mediawiki/extensions/UrlShortener@REL1_44] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1307225

Change #1307226 had a related patch set uploaded (by SBassett; author: Derick Alangi):

[mediawiki/extensions/UrlShortener@REL1_43] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1307226

Change #1307222 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@REL1_45] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1307222

Change #1307225 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@REL1_44] SECURITY: Correctly handle imposter URLs with a default setup

https://gerrit.wikimedia.org/r/1307225