## Summary
The #ipinfo extension has a infobox widget that is currently vulnerable to message key XSS (through checking with the `x-xss` language). These XSS vectors should be fixed.
## Background
- The `x-xss` language allows finding messages which are not properly escaped in MediaWiki interfaces
- The #IPinfo extension displays an "infobox" or "popup" widget on pages like `Special:Contributions` or the history page
-- This gives the IP address being used or the IP associated with a temporary account
- When using the `x-xss` language on `Special:Contributions` and the history page, there are several popup alerts that indicate the #ipinfo is not properly escaping these messages for both the "infobox" and "popup" widgets
- The messages which are vulnerable:
-- `ipinfo-value-ipversion-ipv4`
-- `ipinfo-value-ipversion-ipv6`
-- `ipinfo-value-active-blocks`
-- `ipinfo-value-local-edits`
-- `ipinfo-value-recent-edits`
-- `checkuser-ipinfo-global-contributions-value`
## Technical notes
To reproduce:
# Set `$wgUseXssLanguage` to be `true`
# Load `Special:Contributions` for either a temporary account or IP
# Open the infobox
# Accept the IPInfo preference (if needed)
## Acceptance criteria
- [ ] The #ipinfo infobox component no longer has any messages that are vulnerable to message key XSS