## Summary
The #checkuser extension has `Special:CheckUser` which is currently vulnerable to i18n XSS (through checking with the `x-xss` language). These XSS vectors should be fixed.
## Background
- The `x-xss` language allows finding messages which are not properly escaped in MediaWiki interfaces
- The #checkuser extension has `Special:CheckUser` for checking users to see if they have performed abuse through sockpuppetry
- When using the `x-xss` language on `Special:CheckUser` after submitting the form, there are several popup alerts that indicate the #checkuser is not properly escaping these messages
- The messages which are vulnerable:
-- `checkuser-investigate-compare-table-cell-unregistered`
-- `rev-deleted-user`
## Technical notes
To reproduce:
# Set `$wgUseXssLanguage` to be `true`
# Create a user which is then suppressed
# Load `Special:CheckUser`
# Modify the HTML of the POST form to include a hidden input field that sets `uselang` to `x-xss` in the POST request (e.g. add `<input type="hidden" value="x-xss" name="uselang">` somewhere inside the `<form>` element)
## This is needed because we can't add the `uselang=x-xss` query param to the URL as the checks use POST requests
# Submit the form
## Screenshots
{F60242844}
## Acceptance criteria
- [ ] The #checkuser `Special:CheckUser` page is no longer vulnerable to i18n XSS