robchur wrote:

Confirmed, though haven't identified if it's the Lucene extension, the built-in
search or something special about the fallback behaviour at the moment. Looking now.

robchur wrote:

Aha. http://fr.wikipedia.org/wiki/MediaWiki:Monobook.js seems to have a useful
little hack (do a find in your browser for "yahooSearch") which contains the
vulnerability.

I've corrected the bad JS code on these sites.

Sigh.

robchur wrote:

Another vote against custom JavaScript. Sadly, administrators are not
necessarily l33t script writers as well...

bugzilla-wikipedia wrote:

This specific XSS was corrected.
What about other vectors?

Attack vector

"<>"<script>alert('XSS')</script>

PoC

http://fr.wikipedia.org/wiki/Special:Search?search=%22%3C%3E%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go
http://nl.wikipedia.org/wiki/Special:Search?search=%22%3C%3E%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go
http://ru.wikipedia.org/wiki/Special:Search?search=%22%3C%3E%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go

Bug reopened.

Man, I have JavaScript's class library (such as it is). String's replace() method only replaces the first occurance
by default. *boggle*

Fixed.

dake.cdx wrote:

Another vote against custom JavaScript. Sadly, administrators are not
necessarily l33t script writers as well...

Well, how long have we been waiting for a better search page ? Administrators
are just patching :) Though for that XSS stuff I plead 100% guilty, I completely
forgot the XSS issue. Another piece of code I made, the array generator
("popupTableau") is more secure (I hope) as inputs go through JS parsing functions.

dake.cdx wrote:

btw. Brion is right, JS sucks.