I started doing this, and quickly found that we support specifying log parameters like 4:raw:foo, where raw stands for raw HTML. So that's an obvious XSS when the parameters are used-controlled. There are no uses of this feature in core or in any extension in Codesearch.

As far as I can tell, there are no other XSS issues in core log formatters, but they can throw exceptions in some cases.

Here's a patch that cleans up some scary-looking (but harmless) Phan SecurityCheck annotations. I intend to submit it to Gerrit after the security release is out.

And here's a patch that adds a unit test that runs all known log formatters with weird inputs. It shows that there are no obvious escaping problems in core, but there are some crashes (20 tests failed, 127 passed). You could run it against extensions with some small changes (see code comments), which results in more failures. I don't plan to work on this further; we would probably need a lot of work to actually safely support user-controlled parameters (like a per-log-type schema for them, or something), and I think the user right check added in T422244 is safe enough.

In T422995#11810693, @matmarex wrote:

I started doing this, and quickly found that we support specifying log parameters like 4:raw:foo, where raw stands for raw HTML. So that's an obvious XSS when the parameters are used-controlled. There are no uses of this feature in core or in any extension in Codesearch.

0001-SECURITY-LogFormatter-raw-parameter-format-is-no-lon.patch2 KBDownload

CR+2, thanks.

I would include this patch in the upcoming security release.

I've added T421264 (the next core release tracking bug) as a parent task for this task.

In T422995#11810697, @matmarex wrote:

Here's a patch that cleans up some scary-looking (but harmless) Phan SecurityCheck annotations. I intend to submit it to Gerrit after the security release is out.

0002-LogFormatter-Improve-Phan-SecurityCheck-annotations.patch10 KBDownload

Sounds good, thanks. The release should be out sometime towards the end of June 2026 (cc: @Reedy).

And here's a patch that adds a unit test that runs all known log formatters with weird inputs. It shows that there are no obvious escaping problems in core, but there are some crashes (20 tests failed, 127 passed). You could run it against extensions with some small changes (see code comments), which results in more failures. I don't plan to work on this further; we would probably need a lot of work to actually safely support user-controlled parameters (like a per-log-type schema for them, or something), and I think the user right check added in T422244 is safe enough.

0003-WIP-Add-tests-for-running-log-formatters-with-bad-pa.patch3 KBDownload

So this isn't really mergeable right now then, more of a means of testing current core functionality?

So this isn't really mergeable right now then, more of a means of testing current core functionality?

Correct, many of the test cases are failing.

Change #1306232 had a related patch set uploaded (by Reedy; author: Bartosz Dziewoński):

[mediawiki/core@master] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306232

Change #1306242 had a related patch set uploaded (by Reedy; author: Bartosz Dziewoński):

[mediawiki/core@REL1_45] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306242

Change #1306232 merged by jenkins-bot:

[mediawiki/core@master] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306232

Change #1306242 merged by jenkins-bot:

[mediawiki/core@REL1_45] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306242

Change #1306270 had a related patch set uploaded (by Reedy; author: Bartosz Dziewoński):

[mediawiki/core@REL1_44] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306270

Change #1306270 merged by jenkins-bot:

[mediawiki/core@REL1_44] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306270

Change #1306314 had a related patch set uploaded (by Reedy; author: Bartosz Dziewoński):

[mediawiki/core@REL1_43] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306314

Change #1306335 had a related patch set uploaded (by Reedy; author: Bartosz Dziewoński):

[mediawiki/core@REL1_46] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306335

Change #1306314 merged by Reedy:

[mediawiki/core@REL1_43] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306314

Change #1306335 merged by jenkins-bot:

[mediawiki/core@REL1_46] SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML

https://gerrit.wikimedia.org/r/1306335

Release has been made, so as promised, I will submit the cleanup patch from T422995#11810697 to Gerrit now. I think this task can be resolved once that one is merged (just to master).

Change #1306403 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] LogFormatter: Improve Phan SecurityCheck annotations

https://gerrit.wikimedia.org/r/1306403

Change #1306403 merged by jenkins-bot:

[mediawiki/core@master] LogFormatter: Improve Phan SecurityCheck annotations

https://gerrit.wikimedia.org/r/1306403