Editors have been banned for using tides in their signatures (among other things):
https://en.wikipedia.org/wiki/Wikipedia:Requests_for_arbitration/-Ril-#Sig_change
The issue is that if you set your 'fancy' signature to `~~~~` it gets inserted literally in the output, and then the next editor to save the talk page gets *their* signature substituted, causing the evil editor's comments to be misattributed.
Code was added in 2006 to prevent this: 682e6e96e035e95dc44c8f17ce050bb7c16f60e2
But this is ineffective. For example consider the signature `~~{{subst:1x{{subst:1x|{{subst:!}}}}}}~~`. This gets expanded on first save to `~~{{subst:1x|}}~~` which will then be treated as `~~~~` on a subsequent save (`subst` is handled before signature insertion).
This isn't really a security bug: we have a policy in place forbidding confusing signatures in general, and the original author is stored in the version history. But it is a case where our attempted sanitization is imperfect.
---
=== Dependencies
The patches to meet the "Requirements" described below should NOT be merged until the following tickets are resolved:
- {T254613}
- {T254614}
=== Requirements
- When someone attempts to save a signature that does not meet the conditions below, present a message that explains to people: 1) that their signature cannot be saved as it is currently written, 2) why their signature cannot be saved as it is currently written and 3) what changes they need to make to the signature they have written in order to save it.
-- Conditions:
--- The signature contains syntax that produces another `{{subst:...}}` or `~~~...` after the substitution (which would be then substituted again when the next user edits the page), //as described in T230652#5966006//
=== Done
- [ ] Patches are written that meet the "Requirements" described above