Set the title to something like
"<big><big><big><big>test"
and you end up with
https://test.wikipedia.org/w/index.php?title=Campaign:wlm-pl&oldid=179050
(Sitenote, there's a bug where <'s get changed into random unicode characters. filing that separately.)
Version: unspecified
Severity: normal
URL: https://test.wikipedia.org/w/index.php?title=Campaign:wlm-pl&oldid=179050
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| UploadWizardCampaign: Enable tidy when parsing | Bartosz Dziewoński | mediawiki/extensions/UploadWizard | master | +1 -0 |
Perhaps should pass things through tidy before outputting them. These are already passed through the wikitext parser, so should not cause XSS issues.
Or perhaps, if people want to fuck up the page, let them?
Change 252688 had a related patch set uploaded (by Bartosz Dziewoński):
UploadWizardCampaign: Enable tidy when parsing