Ensure html in data-mw can't be manipulated by attacker before being loaded on ContentTranslation
Closed, InvalidPublic
Actions

Assigned To

Authored By

	• csteipp
	Jan 14 2015, 12:14 AM

Description

Currently, this is prevented by checking the typeof attribute on the reference element, but if a wiki sets $wgAllowRdfaAttributes = true, this will no longer be effective.

Related Objects

Mentioned In: T85686: Content Translation Beta Feature security review

Event Timeline

• csteipp created this task.Jan 14 2015, 12:14 AM

• csteipp raised the priority of this task from to Needs Triage.

• csteipp updated the task description. (Show Details)

• csteipp subscribed.

• csteipp mentioned this in T85686: Content Translation Beta Feature security review.Jan 14 2015, 12:22 AM

Nikerabbit claimed this task.Jan 14 2015, 7:18 AM

Nikerabbit triaged this task as High priority.

Nikerabbit added projects: ContentTranslation, Language-Team.

Nikerabbit set Security to None.

Per private email conversations (sorry about that) this is in fact not an issue. Parsoid will prefix conflicting data and typeof attributes.

Ensure html in data-mw can't be manipulated by attacker before being loaded on ContentTranslationClosed, InvalidPublicActions

Description

Related Objects

Event Timeline

Ensure html in data-mw can't be manipulated by attacker before being loaded on ContentTranslation
Closed, InvalidPublic
Actions