Change Details

I'm preemptively adding this to security since I won't try a possible XSS on a public wiki, in case someone else notices that. A `<tt>` tag from the topic title was leaked in an echo notification of [[ https://www.mediawiki.org/wiki/Topic:St40qdktkrptckcl | this flow post ]] (a thanks action). {F3045525} `tt` is allowed in wikitext. I'm not sure if something like a `<script>` could be leaked too, which could be disastrous. **Confirmed: It's not an issue.** It also parses templates, see T123543

I'm preemptively adding this to security since I won't try a possible XSS on a public wiki, in case someone else notices that. A `<tt>` tag from the topic title was leaked in an echo notification of [[ https://www.mediawiki.org/wiki/Topic:St40qdktkrptckcl | this flow post ]] (a thanks action). {F3045525} `tt` is allowed in wikitext. I'm not sure if something like a `<script>` could be leaked too, which could be disastrous. **Confirmed: It's not an issue.** It also parses templates, see T123543 Earlier testing by @Etonkovidova. Basically the resultsa are all wrong: Tested on test.wikipedia.org | data |Flow topic titles|Echo flyout|Notification page | <code></code> | plain text| as code text| as code text |<script>alert(1)</script>| plain text| plain text| plain text |<tt>|plain text|**is not displayed**|monospace; **changes all text to monospace** |{{release}}| plain text|**red link**|**red link** |<!--T:1-->|plain text|plain text|plain text |<translate>|plain text|plain text|plain text

I'm preemptively adding this to security since I won't try a possible XSS on a public wiki, in case someone else notices that. A `<tt>` tag from the topic title was leaked in an echo notification of [[ https://www.mediawiki.org/wiki/Topic:St40qdktkrptckcl | this flow post ]] (a thanks action). {F3045525} `tt` is allowed in wikitext. I'm not sure if something like a `<script>` could be leaked too, which could be disastrous. **Confirmed: It's not an issue.** It also parses templates, see T123543 Earlier testing by @Etonkovidova. Basically the resultsa are all wrong: Tested on test.wikipedia.org | data |Flow topic titles|Echo flyout|Notification page | <code></code> | plain text| as code text| as code text |<script>alert(1)</script>| plain text| plain text| plain text |<tt>|plain text|**is not displayed**|monospace; **changes all text to monospace** |{{release}}| plain text|**red link**|**red link** |<!--T:1-->|plain text|plain text|plain text |<translate>|plain text|plain text|plain text