Change Details

An example (from T144100) is https://meta.wikimedia.org/wiki/<script>?curid=79155; oldid and diff could probably be used to the same effect. Rejecting such requests with a HTTP 400 might be marginally safer as URLs end up in various logs and reports and some of those might incorrectly assume that the path part of an URL served with HTTO 200 is safe. Similarly, some user scripts might incorrectly assume that the URL of a page which has content is safe (although they really should get the title via mw.config). It would also improve the precision of WMF pageview stats which use the usually-but-not-always correct assumption that the name of a page served with HTTP 200 is the same as the name in the URL.

An example (from T144100) is https://meta.wikimedia.org/wiki/<script>?curid=79155; `oldid` and `diff` could probably be used to the same effect. Rejecting such requests with a HTTP 400 might be marginally safer as URLs end up in various logs and reports and some of those might incorrectly assume that the path part of an URL served with HTTO 200 is safe. Similarly, some user scripts might incorrectly assume that the URL of a page which has content is safe (although they really should get the title via mw.config). It would also improve the precision of WMF pageview stats which use the usually-but-not-always correct assumption that the name of a page served with HTTP 200 is the same as the name in the URL.

An example (from T144100) is https://meta.wikimedia.org/wiki/<script>?curid=79155; `oldid` and `diff` could probably be used to the same effect. Rejecting such requests with a HTTP 400 might be marginally safer as URLs end up in various logs and reports and some of those might incorrectly assume that the path part of an URL served with HTTO 200 is safe. Similarly, some user scripts might incorrectly assume that the URL of a page which has content is safe (although they really should get the title via mw.config). It would also improve the precision of WMF pageview stats which use the usually-but-not-always correct assumption that the name of a page served with HTTP 200 is the same as the name in the URL.