Page MenuHomePhabricator
Create Task
Maniphest T426466

SecurePoll should reject votes with CSRF issues
Open, Needs TriagePublic
Actions

Description

Cross-site request forgery is a risk to SecurePoll for reasons described in that link. However, the signal could be caused by benign issues like token timeouts, and this leads to confusion for scrutineers (see the recent task T426370, but it has certainly come up before).

I would recommend implementing a check for CSRF and just rejecting the vote immediately, asking the user to re-submit. This assumes CSRF is flagged immediately on submission of the vote and I'm not sure if that is the case.

See also work done in the recent past on this and other SecurePoll issues: T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation

Related Objects

Event Timeline

jrbs created this task.May 15 2026, 7:43 PM
Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptMay 15 2026, 7:43 PM
Restricted Application added a subscriber: • Aklapper. · View Herald Transcript
jrbs added projects: MediaWiki-extensions-SecurePoll, Vuln-CSRF.May 15 2026, 7:44 PM
Novem_Linguae subscribed.EditedMay 15 2026, 8:07 PM

I think we can make this ticket public. The fact that securepoll can detect csrf abnormalities is not a secret and can be found in our public source code. And i don't think there's an exploit here, just a proposal to get rid of a not very helpful scrutineering signal by changing/improving the design.

sbassett subscribed.May 15 2026, 8:15 PM
In T426466#11927108, @Novem_Linguae wrote:

I think we can make this ticket public. The fact that securepoll can detect csrf abnormalities is not a secret and can be found in our public source code. And i don't think there's an exploit here, just a proposal to get rid of a not very helpful scrutineering signal by changing/improving the design.

I'm personally fine with this being public.

Johannnes89 subscribed.May 15 2026, 9:06 PM
jrbs added a comment.May 15 2026, 9:13 PM

Yep fine with me. I was just being overly cautious :)

Catrope removed a project: Security-Team.May 18 2026, 4:34 PM
Catrope changed the subtype of this task from "Security Issue" to "Task".
Catrope changed the visibility from "Custom Policy" to "Public (No Login Required)".
Catrope changed the edit policy from "Custom Policy" to "All Users".
A_smart_kitten subscribed.May 18 2026, 4:38 PM
Zzuuzz subscribed.May 20 2026, 8:38 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits