Page MenuHomePhabricator
Create Task
Maniphest T418533

CVE-2026-13706: UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG
Closed, ResolvedPublicSecurity
Actions

Description

UrlShortner validates and parses urls based on MediaWiki's url parsing functions which are based on PHP's parse_url function with a couple fixes.

However, PHP's url parsing functions do not follow the WHATWG standard that web browsers use.

As a result you can shorten urls that you shouldn't be able to. For example: https://w.wiki/H$rD which goes to my personal website (Based on differing interpretations on how \ is handled in hostnames).

Inspired by T418431

Details

Risk Rating
Medium
Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: remove backslashes from host portion of parsed urlReedymediawiki/extensions/UrlShortenermaster+9 -0
SECURITY: remove backslashes from host portion of parsed urlReedymediawiki/extensions/UrlShortenerREL1_43+9 -0
SECURITY: remove backslashes from host portion of parsed urlReedymediawiki/extensions/UrlShortenerREL1_45+9 -0
SECURITY: remove backslashes from host portion of parsed urlReedymediawiki/extensions/UrlShortenerREL1_44+9 -0
SECURITY: remove backslashes from host portion of parsed urlReedymediawiki/extensions/UrlShortenerREL1_46+9 -0
Customize query in gerrit

Related Objects

Event Timeline

Bawolff created this task.Feb 26 2026, 8:19 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 26 2026, 8:19 PM
Bawolff added a subscriber: • DAlangi_WMF.Feb 26 2026, 8:21 PM
Bawolff added a project: MediaWiki-extensions-UrlShortener.Feb 26 2026, 8:26 PM
sbassett added a project: SecTeam-Processed.Mar 2 2026, 5:32 PM
sbassett moved this task from Incoming to Watching on the Security-Team board.
sbassett added subscribers: • matmarex, Krinkle.
• matmarex added a comment.Mar 2 2026, 6:50 PM

PHP 8.5 includes a WHATWG-compliant URL class: https://www.php.net/releases/8.5/en.php#new-uri-extension. There is a polyfill for PHP 8.1+: https://github.com/thephpleague/uri-polyfill.

I don't know if it's feasible to switch to that just for this one thing in UrlShortener. I hope that one day we switch to using it more generally (instead of parse_url and our own wfParseUrl/UrlUtils), but that will be a long effort, probably at least as much work as the switch we did on the JS side (T374314).

Bawolff added a comment.Mar 3 2026, 3:06 AM

Failing converting to WHATWG compliant parser, just checking to make sure that the host part of the url does not contain \ would probably prevent the most serious issues

sbassett triaged this task as Medium priority.Mar 23 2026, 9:41 PM
sbassett added a project: Vuln-InputValidation.
sbassett changed Risk Rating from N/A to Medium.
sbassett added a project: Patch-For-Review.EditedMar 24 2026, 4:01 PM
sbassett added subscribers: Esanders, Umherirrender, sbassett.

Would this work as a simple security patch, for now, based upon @Bawolff's assessment above?

01-T418533.patch1 KBDownload

There appear to only be 20 urls currently within wikishared.urlshortcodes in Wikimedia production that have a \. pattern in them. And most of them appear to be false positives, within abnormal query parameter values. Though there are definitely a few where folks have clearly tried this trick:

+---------+
| usc_url |                                                                                                                                                                                                                              +---------+
http://www.google.com\.wikipedia.org/                                                                                                                                                                                                
http://www.google.com\.wikipedia.org/\..\                                                                                                                                                                                            
http://www.google.com\.wikipedia.org/\..\..\                                                                                                                                                                                        
http://tools.usps.com\.wikipedia.org/\..\..\go/TrackConfirmAction?qtc_tLabels1=9200190388491201512135                                                                                                                                
http://www.google.com\.wikipedia.org/\..\..\search?q=wikipedia&hl=en-US&safe=active#bfoot                                                                                                                                            
http://www.google.com\.wikipedia.org/..\search?q=wikipedia&hl=en-US&safe=active#bfoot                                                                                                                                                
http://www.google.com\.wikipedia.org/search?q=wikipedia&hl=en-US&safe=active#bfoot                                                                                                                                                   
http://www.youtube.com\.wikipedia.org/..\watch?v=dQw4w9WgXcQ
sbassett changed the task status from Open to In Progress.Mar 24 2026, 4:16 PM
sbassett moved this task from Watching to In Progress on the Security-Team board.
sbassett moved this task from In Progress to Security Patch To Deploy on the Security-Team board.Mar 31 2026, 3:50 PM
• matmarex added a comment.Apr 11 2026, 2:53 PM

+1, patch looks good to me.

sbassett added a comment.Apr 13 2026, 9:46 PM

Deployed the patch from T418533#11744838.

sbassett mentioned this in T421273: Write and send supplementary release announcement for extensions and skins with security patches (1.43.9/1.44.6/1.45.4).Apr 13 2026, 9:46 PM
sbassett moved this task from Security Patch To Deploy to Watching on the Security-Team board.
Reedy subscribed.Jun 22 2026, 9:32 PM

Any reason this patch can't actually go through gerrit? It's not a bundled extension etc.

Security release due this week, so would be good to start clearing up the WMF deployed board

sbassett added a comment.Jun 22 2026, 9:46 PM
In T418533#12042826, @Reedy wrote:

Any reason this patch can't actually go through gerrit? It's not a bundled extension etc.

It can go out with the supplemental, we have it tracked there.

Reedy edited subscribers, added: gerritbot; removed: • DAlangi_WMF.Jun 29 2026, 1:14 PM
gerritbot added a comment.Jun 29 2026, 1:19 PM

Change #1306273 had a related patch set uploaded (by Reedy; author: SBassett):

[mediawiki/extensions/UrlShortener@master] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306273

Reedy renamed this task from UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG to CVE-2026-13706: UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG.Jun 29 2026, 1:21 PM
gerritbot added a comment.Jun 29 2026, 2:04 PM

Change #1306273 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@master] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306273

gerritbot added a comment.Jun 29 2026, 2:05 PM

Change #1306293 had a related patch set uploaded (by Reedy; author: SBassett):

[mediawiki/extensions/UrlShortener@REL1_46] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306293

gerritbot added a comment.Jun 29 2026, 2:06 PM

Change #1306294 had a related patch set uploaded (by Reedy; author: SBassett):

[mediawiki/extensions/UrlShortener@REL1_45] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306294

gerritbot added a comment.Jun 29 2026, 2:06 PM

Change #1306295 had a related patch set uploaded (by Reedy; author: SBassett):

[mediawiki/extensions/UrlShortener@REL1_44] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306295

gerritbot added a comment.Jun 29 2026, 2:07 PM

Change #1306297 had a related patch set uploaded (by Reedy; author: SBassett):

[mediawiki/extensions/UrlShortener@REL1_43] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306297

gerritbot added a comment.Jun 29 2026, 2:14 PM

Change #1306293 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@REL1_46] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306293

gerritbot added a comment.Jun 29 2026, 2:15 PM

Change #1306295 merged by jenkins-bot:

[mediawiki/extensions/UrlShortener@REL1_44] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306295

gerritbot added a comment.Jun 29 2026, 2:16 PM

Change #1306294 merged by Reedy:

[mediawiki/extensions/UrlShortener@REL1_45] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306294

gerritbot added a comment.Jun 29 2026, 2:17 PM

Change #1306297 merged by Reedy:

[mediawiki/extensions/UrlShortener@REL1_43] SECURITY: remove backslashes from host portion of parsed url

https://gerrit.wikimedia.org/r/1306297

Umherirrender unsubscribed.Jul 3 2026, 9:07 PM
Tgr subscribed.Sat, Aug 1, 4:57 PM

Potential followup: T433771: Replace UrlUtils::parse() and parse_url() with Uri\WhatWg\Url

sbassett closed this task as Resolved.Mon, Aug 3, 5:13 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett removed a project: Patch-For-Review.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits