Page MenuHomePhabricator

Dom xss in redirectedFromArticle script
Closed, ResolvedPublic

Description

Reflected dom xss on sites using the redirectedFromArticle script.

Visit a url like:
Wikipédia:Redirect_vers_Wikibooks?debug=true#<t0>.23<t1>.23<img%20src=food%20onerror="alert(1)"/>

Seems to be in Common.js on:
frp.wikipedia.org
frp.wikipedia.org
frp.wikipedia.org
frp.wikipedia.org
oc.wikipedia.org
oc.wikipedia.org
oc.wikipedia.org
oc.wikipedia.org
wo.wikipedia.org
wo.wikipedia.org
wo.wikipedia.org
wo.wikipedia.org


Version: unspecified
Severity: normal

Details

Reference
bz47127

Event Timeline

bzimport raised the priority of this task from to Low.Nov 22 2014, 1:29 AM
bzimport added a project: Security-Other.
bzimport set Reference to bz47127.
bzimport changed Security from none to Software security bug.
Restricted Application changed the visibility from "Public (No Login Required)" to "acl*security (Project)". · View Herald TranscriptNov 22 2014, 1:29 AM
Restricted Application changed the edit policy from "All Users" to "acl*security (Project)". · View Herald Transcript
Restricted Application changed the visibility from "acl*security (Project)" to "Custom Policy". · View Herald TranscriptNov 24 2014, 9:28 PM
Restricted Application changed the edit policy from "acl*security (Project)" to "Custom Policy". · View Herald Transcript

The code is no longer present on any wikis.

frp.wikipedia.org already didn't have it (was removed by a local admin in June last year).
orc.wikipedia.org and wo.wikipedia.org still had it, I removed it just now (diff 1, diff 2).

I also verified through mwgrep that code like it hasn't been introduced on any of the other 895 wikis, either ("redirected_from", "redirectedFromArticleDatas", etc.)

Krinkle claimed this task.
matmarex changed the visibility from "Custom Policy" to "Public (No Login Required)".Jun 3 2017, 10:24 AM
matmarex changed the edit policy from "Custom Policy" to "All Users".

There is doRedirect() on https://or.wiktionary.org/wiki/MediaWiki:Common.js which passes var wiktDYMfrom = decodeURIComponent(location.href.replace(/^(.+[&\?]rdfrom=([^&]+).*|.*)?$/,"$2")); to mw.util.getUrl. Could be removed since T5339 is fixed, maybe.