Change Details

**Steps to replicate the issue**: * Using the current AdvancedSiteNotices gadget (revision [[https://zh.wikipedia.org/wiki/Special:PermanentLink/83152108|83152108]]) on zhwiki, and insert the following content into the template `Template:AdvancedSiteNotices/ajax`: ``` <ul class="sitents" data-asn-version=""> <li data-asn-criteria="<nowiki>(async()=>{if(!window.localStorage||window.localStorage.ASNTest)return;const accept=await OO.ui.confirm('Click to confirm and you will be logged out');if(accept){const api=new mw.Api();try{await api.postWithEditToken({action:'logout'});}catch(e){}window.location.reload();}else{window.localStorage.ASNTest='PASS';}})();true</nowiki>">Test</li> </ul> ``` **What happens?**: You should see a popup informing you that if you click "Confirm," you will be logged out. If you do click "Confirm," you will be logged out immediately. On the other hand, if you click "No," you should not see this popup again as long as it remains stored in localStorage. **Details**: Although this is not a software bug, I believe it should be submitted as a security task because it is a default-enabled gadget that can be used for XSS attacks on [[https://global-search.toolforge.org/?q=.*eval%5C%28.*&regex=1&namespaces=8&title=Gadget-AdvancedSiteNotices.js|seven wikis in total]]. The Advanced Site Notices gadget on zhwiki was designed using eval() to parse `criteria` expressions without any controls. In other words, this allows for XSS attacks to be executed solely through wikitext. Although `Template:AdvancedSiteNotices` on zhwiki is "Full protection", not all of them are fully protected, potentially enabling regular users to execute this attack. It is also worth mentioning that setting the `data-asn-html-raw` attribute to valid HTML could potentially lead to XSS attacks, although this has not yet been tested. Thanks to @Diskdance for mentioning that the gadget contains the eval function.

**Steps to replicate the issue**: * Using the current AdvancedSiteNotices gadget (revision [[https://zh.wikipedia.org/wiki/Special:PermanentLink/83152108|83152108]]) on zhwiki, and insert the following content into the template `Template:AdvancedSiteNotices/ajax`: ``` <ul class="sitents" data-asn-version=""> <li data-asn-criteria="<nowiki>(async()=>{if(!window.localStorage||window.localStorage.ASNTest)return;const accept=await OO.ui.confirm('Click to confirm and you will be logged out');if(accept){const api=new mw.Api();try{await api.postWithEditToken({action:'logout'});}catch(e){}window.location.reload();}else{window.localStorage.ASNTest='PASS';}})();true</nowiki>">Test</li> </ul> ``` **What happens?**: You should see a popup informing you that if you click "Confirm," you will be logged out. If you do click "Confirm," you will be logged out immediately. On the other hand, if you click "No," you should not see this popup again as long as it remains stored in localStorage. **Details**: Although this is not a software bug, I believe it should be submitted as a security task because it is a default-enabled gadget that can be used for XSS attacks on [[https://global-search.toolforge.org/?q=.*eval%5C%28.*&regex=1&namespaces=8&title=Gadget-AdvancedSiteNotices.js|seven wikis in total]]. The Advanced Site Notices gadget on zhwiki was designed using `eval()` to parse `criteria` expressions without any controls. In other words, this allows for XSS attacks to be executed solely through wikitext. Although `Template:AdvancedSiteNotices` on zhwiki is protected to be only editable by admin, we should avoid using `eval()` as a defense in depth. It is also worth mentioning that setting the `data-asn-html-raw` attribute to valid HTML could potentially lead to XSS attacks, although this has not yet been tested. Thanks to @Diskdance for mentioning that the gadget contains the eval function.

**Steps to replicate the issue**: * Using the current AdvancedSiteNotices gadget (revision [[https://zh.wikipedia.org/wiki/Special:PermanentLink/83152108|83152108]]) on zhwiki, and insert the following content into the template `Template:AdvancedSiteNotices/ajax`: ``` <ul class="sitents" data-asn-version=""> <li data-asn-criteria="<nowiki>(async()=>{if(!window.localStorage||window.localStorage.ASNTest)return;const accept=await OO.ui.confirm('Click to confirm and you will be logged out');if(accept){const api=new mw.Api();try{await api.postWithEditToken({action:'logout'});}catch(e){}window.location.reload();}else{window.localStorage.ASNTest='PASS';}})();true</nowiki>">Test</li> </ul> ``` **What happens?**: You should see a popup informing you that if you click "Confirm," you will be logged out. If you do click "Confirm," you will be logged out immediately. On the other hand, if you click "No," you should not see this popup again as long as it remains stored in localStorage. **Details**: Although this is not a software bug, I believe it should be submitted as a security task because it is a default-enabled gadget that can be used for XSS attacks on [[https://global-search.toolforge.org/?q=.*eval%5C%28.*&regex=1&namespaces=8&title=Gadget-AdvancedSiteNotices.js|seven wikis in total]]. The Advanced Site Notices gadget on zhwiki was designed using `eval()` to parse `criteria` expressions without any controls. In other words, this allows for XSS attacks to be executed solely through wikitext. Although `Template:AdvancedSiteNotices` on zhwiki is "Full protection", not all of them are fully protecteded to be only editable by admin, potentially enablwe should avoid using regular users to execute this attack`eval()` as a defense in depth. It is also worth mentioning that setting the `data-asn-html-raw` attribute to valid HTML could potentially lead to XSS attacks, although this has not yet been tested. Thanks to @Diskdance for mentioning that the gadget contains the eval function.