Context

Wikibase currently uses a homegrown templating system to assemble the user interface HTML both in PHP and in JS. In this templating system (view/src/Template/ + view/resources/wikibase/templates.js), the caller is responsible for escaping any template arguments; forgetting to escape an argument can result in a security vulnerability (e.g. T339111: CVE-2023-37302: Style injection into badges on Wikidata due to unescaped quotes. Escape messages in TermsListView).

At some later time, MediaWiki core gained support for mustache-based templates, also both in PHP and JS. This system escapes template arguments by default; parameters that should not be escaped are marked in the template and can easily be searched for and audited (git grep -F '{{{' '*.mustache'). Template arguments are also passed by name in this system ({{title}}) rather than by number as in Wikibase’s system ($2).

Main Objectives

The objective of this task is to migrate all uses of the old templating system in Wikibase to the new system, and eventually remove the old system from Wikibase altogether. This will make the code more readable, more similar to other MediaWiki extensions, and help to prevent future security vulnerabilities. It will also probably reduce the coupling within Wikibase (since the bindings to Wikibase’s template system will be gone).

Considerations

Since we use the same templates in PHP and JS, and the template syntax will change, care must be taken to migrate PHP and JS at the same time. That said, it might be possible to split the migration by template (i.e., do the PHP+JS migration of wikibase-statementgrouplistview first, then the PHP+JS migration of wikibase-entitytermsview, etc.).