Page MenuHomePhabricator

nsToken GET parameter to Special:Search should be a salted version of the edit token instead of just plain edit token
Closed, ResolvedPublic


patch to salt the token

(Going back and forth if I should file under security. Decided to err on the side of caution, but this really isn't a serious issue, just something that should be done as a precaution)

Special:Search has an nsToken parameter, that's the same as edit token. Its used for saving namespace selection to preferences. The parameter is passed as a GET parameter. Since edit tokens are secret and GET parameters can end up showing up in public places (If people copy paste urls, log files, etc), the token should be salted like we do with "watch this page" tokens.

For reference, change is in commit 5dc4dc099d8799cf98dc

Version: unspecified
Severity: normal




Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 3:30 AM
bzimport added a project: MediaWiki-Search.
bzimport set Reference to bz67210.
bzimport added a subscriber: Unknown Object (MLST).

Yes, please. Since there's no threat of stealing the token directly, I'm fine if this is made public (we can put the patch in gerrit, etc). But we really should be salting the token as a standard hardening / precaution.

Thanks Bawolff!

Sorry. I did think the token was going to make the URL uglier to share but I neglected to think it could be reused.

Change 142900 had a related patch set uploaded by Brian Wolff:
Salt the "nsToken" used for Special:Search namespace remembering

Change 142900 merged by jenkins-bot:
Salt the "nsToken" used for Special:Search namespace remembering