⚓ T86643 WikiEditor interprets names of predefined Object prototype methods as valid language names

	Subject	Repo	Branch	Lines +/-
	Use "obj.hasOwnProperty( prop )" instead of "prop in obj"	mediawiki/extensions/WikiEditor	master	+6 -3

Fomafix claimed this task.

Fomafix raised the priority of this task from to Medium.

Fomafix updated the task description. (Show Details)

Fomafix changed Security from None to Software security bug.

Fomafix subscribed.

Restricted Application changed the visibility from "Public (No Login Required)" to "Custom Policy". · View Herald TranscriptJan 13 2015, 12:33 PM

Restricted Application changed the edit policy from "All Users" to "Custom Policy". · View Herald Transcript

Restricted Application added a project: acl*security. · View Herald Transcript

I'm not sure how this could be exploited... But @Krinkle, should we have an Object.prototype.hasOwnProperty.call( object, ... ) check in autoLang?

I didn't find a possibility to exploit this bug.

Legoktm subscribed.

matmarex changed Security from Software security bug to None.

matmarex changed the visibility from "Custom Policy" to "Public (No Login Required)".

matmarex changed the edit policy from "Custom Policy" to "All Users".

Change 184619 merged by jenkins-bot:
Use "obj.hasOwnProperty( prop )" instead of "prop in obj"

Not a security issue, thankfully.

Restricted Application added a subscriber: Malyacko. · View Herald TranscriptApr 3 2016, 9:53 AM

WikiEditor interprets names of predefined Object prototype methods as valid language names
Closed, ResolvedPublic
Actions