HomePhabricator

WikiCategoryTagCloud: version 1.3 -- lots of security fixes and some other…

Authored by ashley.

Description

WikiCategoryTagCloud: version 1.3 -- lots of security fixes and some other enhancements

  • SECURITY: XSS vector with the following extension parameters (as in <tagcloud some_param="value">): style, class, linkstyle, linkclass
  • SECURITY: possible SQL injection point with the exclude parameter (<tagcloud>exclude=SomeCategory,Another</tagcloud) -- the code now uses Database's makeList() properly and should be secure.
  • SECURITY: made WikiCategoryTagCloud::getBoxExtensionOption() more robust by calling htmlspecialchars() with the ENT_QUOTES parameter, as recommended by [[mw:XSS]]
  • Added extension.json file
  • Moved extension's main logic inside a class into a new file (which makes this diff rather unreadable, sorry)
  • Added extension's CSS from the MW.org info page into a new, separate CSS file which is loaded via ResourceLoader for pages which have the <tagcloud> tag (see WikiCategoryTagCloud::renderTagCloud(), specifically line 72 of WikiCategoryTagCloud.class.php)
  • Bumped version number to 1.3 and added myself to authors

ShoutWiki SVN r3727

Bug: T119118
Bug: T119119

Change-Id: I88612c021983dacac623e11cc87af158ea0b636d

Details