@sbassett, @Reedy: two questions, 1) this seems very unexploitable, can we make it public? 2) Do you all have an opinion on whether this should require a CSRF token? It's an internal API module so we can make the change without having to bother with the breaking change process.

In T212071#8254923, @Legoktm wrote:

1. this seems very unexploitable, can we make it public?

Given @Bawolff and Anomie's reasoning above, I think that's fine.

2. Do you all have an opinion on whether this should require a CSRF token? It's an internal API module so we can make the change without having to bother with the breaking change process.

IMO if we're going to expend energy to fix an issue like this, we should just go ahead and require the token unless there is fear that it will break several existing workflows, etc. Digging around in turnilo, it seems action=scribunto-console endpoints get a pretty small amount of traffic each month, like under 2k hits, most likely.

Change 836962 had a related patch set uploaded (by Legoktm; author: Legoktm):

[mediawiki/extensions/Scribunto@master] Require CSRF token for action=scribunto-console

https://gerrit.wikimedia.org/r/836962

Scripts to fix: https://global-search.toolforge.org/?q=%22scribunto-console%22&namespaces=2%2C4%2C8&title=%28Gadgets-definition%7C.*%5C.js%29

https://meta.wikimedia.org/w/index.php?title=Tech%2FNews%2F2022%2F40&type=revision&diff=23872498&oldid=23871998

I'm pretty concerned that there are gadgets that are calling this API :/ will file a separate task for obsoleting libLua.js.

Anyways, I double-checked, passing the token when it's not needed just results in an API warning:

"warnings": {
  "main": {
    "*": "Unrecognized parameter: token."
  }
},

so it's safe for people to update to using .postWithToken( 'csrf', params ) ASAP.

Change 836962 merged by jenkins-bot:

[mediawiki/extensions/Scribunto@master] Require CSRF token for action=scribunto-console

https://gerrit.wikimedia.org/r/836962

In T212071#8274383, @Legoktm wrote:

Scripts to fix: https://global-search.toolforge.org/?q=%22scribunto-console%22&namespaces=2%2C4%2C8&title=%28Gadgets-definition%7C.*%5C.js%29

I went through and fixed all of these.

In T212071#8355028, @MrStradivarius wrote:

In T212071#8274383, @Legoktm wrote:

Scripts to fix: https://global-search.toolforge.org/?q=%22scribunto-console%22&namespaces=2%2C4%2C8&title=%28Gadgets-definition%7C.*%5C.js%29

I went through and fixed all of these.

Thanks!