[WikibaseRepo] XSS: Labels shown in "In other languages" section of entity view are not escaped
Closed, ResolvedPublic

Description

Insert "<script>alert(1)</script>" in a label and when it's shown in the "In other languages" section, the script snippet is executed.


Version: master
Severity: normal

bzimport added a subscriber: wikidata-bugs.
bzimport set Reference to bz53472.
liangent created this task.Via LegacyAug 28 2013, 1:01 PM
liangent added a comment.Via ConduitAug 28 2013, 1:15 PM

Created attachment 13188
Bugfix for the issue

Another less serious (can only be exploited by admins) XSS is address too.

Attached: bug53472.diff

csteipp added a comment.Via ConduitAug 28 2013, 2:35 PM

Thanks Liangent! That looks like a reasonable fix. Let me do some testing on it, and we'll get it deployed asap.

liangent added a comment.Via ConduitAug 28 2013, 4:12 PM

Created attachment 13189
htmlspecialchars( Utils::fetchLanguageName( $language ) ) too

It looks better for me to htmlspecialchars( Utils::fetchLanguageName( $language ) ) too, though Utils::fetchLanguageName() has a fixed set of outputs currently.

Attached: bug53472.diff

csteipp added a comment.Via ConduitAug 28 2013, 6:37 PM

Reviewed and tested by Aude too. Deployed.

18:37 logmsgbot: csteipp synchronized php-1.22wmf13/extensions/Wikibase
18:35 logmsgbot: csteipp synchronized php-1.22wmf14/extensions/Wikibase

I'll add into gerrit too.

liangent added a comment.Via ConduitAug 28 2013, 8:09 PM

I can confirm this is fixed live.

Abraham added a comment.Via ConduitSep 4 2013, 1:28 PM

Verified in Wikidata demo time

csteipp added a comment.Via ConduitSep 5 2013, 5:05 PM

This was assigned CVE-2013-4307

gerritbot added a project: Patch-For-Review.Via ConduitNov 30 2014, 10:21 PM

Change 176610 had a related patch set (by Dereckson) published:
Extra language names configuration for Wikidata

https://gerrit.wikimedia.org/r/176610

Patch-For-Review

gerritbot added a comment.Via ConduitNov 30 2014, 11:23 PM

Change 176610 had a related patch set uploaded (by Dereckson):
Extra language names configuration for Wikidata

https://gerrit.wikimedia.org/r/176610

Patch-For-Review

csteipp added a project: Security.Via WebMar 26 2015, 8:39 PM

Add Comment