Change Details

The `securepoll-translation-select-import-source-api` system message is inserted as raw HTML by the SecurePoll extension, allowing for stored XSS. ## Reproduction steps 1. Make sure `$wgUseXssLanguage` is set to `true` 2. Go to `/wiki/Special:SecurePoll/translate/1?uselang=x-xss` 3. Click the blue import button {F65758940} ## Cause The message is retrieved in the `plain()` output mode and inserted as raw HTML through an HtmlSnippet: https://gerrit.wikimedia.org/g/mediawiki/extensions/SecurePoll/+/52c7942f243c39f6a2ab332fc0125659e6c78d8d/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js#9 ## Additional information * MediaWiki: 1.45.0-alpha (4ad1e30) * Vector: a13cbaa * SecurePoll: 52c7942

The `securepoll-translation-select-import-source-api` system message is inserted as raw HTML by the SecurePoll extension, allowing for stored XSS. ## Reproduction steps 1. Make sure `$wgUseXssLanguage` is set to `true` 2. Create a poll 3. Go to `/wiki/Special:SecurePoll/translate/1?uselang=x-xss` 4. Click the blue import button {F65758940} ## Cause The message is retrieved in the `plain()` output mode and inserted as raw HTML through an HtmlSnippet: https://gerrit.wikimedia.org/g/mediawiki/extensions/SecurePoll/+/52c7942f243c39f6a2ab332fc0125659e6c78d8d/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js#9 ## Additional information * MediaWiki: 1.45.0-alpha (4ad1e30) * Vector: a13cbaa * SecurePoll: 52c7942

The `securepoll-translation-select-import-source-api` system message is inserted as raw HTML by the SecurePoll extension, allowing for stored XSS. ## Reproduction steps 1. Make sure `$wgUseXssLanguage` is set to `true` 2. Go to `/wiki/Special:SecurePoll/translate/1?uselang=x-xss`Create a poll 3. Go to `/wiki/Special:SecurePoll/translate/1?uselang=x-xss` 4. Click the blue import button {F65758940} ## Cause The message is retrieved in the `plain()` output mode and inserted as raw HTML through an HtmlSnippet: https://gerrit.wikimedia.org/g/mediawiki/extensions/SecurePoll/+/52c7942f243c39f6a2ab332fc0125659e6c78d8d/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js#9 ## Additional information * MediaWiki: 1.45.0-alpha (4ad1e30) * Vector: a13cbaa * SecurePoll: 52c7942