[WikibaseRepo] XSS: Labels shown in "In other languages" section of entity view are not escaped
Closed, ResolvedPublic

Description

Insert "<script>alert(1)</script>" in a label and when it's shown in the "In other languages" section, the script snippet is executed.


Version: master
Severity: normal

bzimport added a subscriber: wikidata-bugs.
bzimport set Reference to bz53472.
liangent created this task.Via LegacyAug 28 2013, 1:01 PM
liangent added a comment.Via ConduitAug 28 2013, 1:15 PM

Created attachment 13188
Bugfix for the issue

Another less serious (can only be exploited by admins) XSS is address too.

Attached: bug53472.diff

csteipp added a comment.Via ConduitAug 28 2013, 2:35 PM

Thanks Liangent! That looks like a reasonable fix. Let me do some testing on it, and we'll get it deployed asap.

liangent added a comment.Via ConduitAug 28 2013, 4:12 PM

Created attachment 13189
htmlspecialchars( Utils::fetchLanguageName( $language ) ) too

It looks better for me to htmlspecialchars( Utils::fetchLanguageName( $language ) ) too, though Utils::fetchLanguageName() has a fixed set of outputs currently.

Attached: bug53472.diff

csteipp added a comment.Via ConduitAug 28 2013, 6:37 PM

Reviewed and tested by Aude too. Deployed.

18:37 logmsgbot: csteipp synchronized php-1.22wmf13/extensions/Wikibase
18:35 logmsgbot: csteipp synchronized php-1.22wmf14/extensions/Wikibase

I'll add into gerrit too.

liangent added a comment.Via ConduitAug 28 2013, 8:09 PM

I can confirm this is fixed live.

Abraham added a comment.Via ConduitSep 4 2013, 1:28 PM

Verified in Wikidata demo time

csteipp added a comment.Via ConduitSep 5 2013, 5:05 PM

This was assigned CVE-2013-4307

gerritbot added a project: Patch-For-Review.Via ConduitNov 30 2014, 10:21 PM

Change 176610 had a related patch set (by Dereckson) published:
Extra language names configuration for Wikidata

https://gerrit.wikimedia.org/r/176610

Patch-For-Review

gerritbot added a comment.Via ConduitNov 30 2014, 11:23 PM

Change 176610 had a related patch set uploaded (by Dereckson):
Extra language names configuration for Wikidata

https://gerrit.wikimedia.org/r/176610

Patch-For-Review

csteipp added a project: Security.Via WebThu, Mar 26, 8:39 PM

Add Comment

Column Prototype
This is a very early prototype of a persistent column. It is not expected to work yet, and leaving it open will activate other new features which will break things. Press "\" (backslash) on your keyboard to close it now.