Page MenuHomePhabricator
Create Task
Maniphest T85864

Special pages, actions and views whose messages don't escape text
Closed, InvalidPublic
Actions

Assigned To
None
Authored By
Nemo_bis
Jan 5 2015, 9:48 PM
Tags
Referenced Files
None
Subscribers
Aklapper
• csteipp
gerritbot
Jdforrester-WMF
Krenair
Liuxinyu970226
Matanya
View All 17 Subscribers
Tokens
"Yellow Medal" token, awarded by Krenair."Grey Medal" token, awarded by RandomDSdevel.

Description

Nikerabbit made a partial list of the (main) places, in core and several extensions, containing messages which don't escape text. Each of those messages is a potential security risk.

== Core ==

=== Edit page/view page/protect page ===

/w/i.php?action=edit&title=Support    word-separator

== WikiEditor ==

wikieditor-toolbar-group-format
wikieditor-toolbar-group-insert
wikieditor-toolbar-help-*

== Semantic MediaWiki ==

2016-11 additions:
* smw_result_noresults
* smw_sbv_docu
* smw-ask-format-selection-help

/wiki/Special:Browse    smw_browse_article
/wiki/Special:Browse    smw_browse_go
/wiki/Special:Browse    categories
/wiki/Special:Browse    smw_isspecprop
/wiki/Special:Browse    isredirect

/wiki/Special:ExportRDF    smw_exportrdf_backlinks
/wiki/Special:ExportRDF    smw_exportrdf_docu
/wiki/Special:ExportRDF    smw_exportrdf_lastdate
/wiki/Special:ExportRDF    smw_exportrdf_recursive
/wiki/Special:ExportRDF    smw_exportrdf_submit

/wiki/Special:Properties    smw_isspecprop
/wiki/Special:Properties    smw_propertyhardlyused
/wiki/Special:Properties    smw_propertylackspage
/wiki/Special:Properties    smw_property_template_notype

/wiki/Special:SearchByProperty    smw_sbv_docu
/wiki/Special:SearchByProperty    smw_sbv_property
/wiki/Special:SearchByProperty    smw_sbv_submit
/wiki/Special:SearchByProperty    smw_sbv_value

/wiki/Special:SMWAdmin    smw_smwadmin_announce
/wiki/Special:SMWAdmin    smw_smwadmin_announcebutton
/wiki/Special:SMWAdmin    smw_smwadmin_announcedocu
/wiki/Special:SMWAdmin    smw_smwadmin_datarefresh
/wiki/Special:SMWAdmin    smw_smwadmin_datarefreshbutton
/wiki/Special:SMWAdmin    smw_smwadmin_datarefreshdocu
/wiki/Special:SMWAdmin    smw_smwadmin_db
/wiki/Special:SMWAdmin    smw_smwadmin_dbbutton
/wiki/Special:SMWAdmin    smw_smwadmin_dbdocu
/wiki/Special:SMWAdmin    smw_smwadmin_docu
/wiki/Special:SMWAdmin    smw_smwadmin_installfile
/wiki/Special:SMWAdmin    smw_smwadmin_mediazilla
/wiki/Special:SMWAdmin    smw_smwadmin_permissionswarn
/wiki/Special:SMWAdmin    smw_smwadmin_questions
/wiki/Special:SMWAdmin    smw_smwadmin_smwhomepage
/wiki/Special:SMWAdmin    smw_smwadmin_support
/wiki/Special:SMWAdmin    smw_smwadmin_supportdocu
/wiki/Special:SMWAdmin    smw-sp-admin-settings-button
/wiki/Special:SMWAdmin    smw-sp-admin-settings-title

/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean)    smw_typearticlecount
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean)    smw_type_header

/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions    smw_browse_article
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions    smw_browse_go
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions    smw_browse_no_incoming
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions    smw_browse_no_outgoing

== Lqt ==
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history    august
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history    december
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history    september

== MobileFrontend ==

Unescaped message mobile-frontend-diffview-comma
Unescaped message mobile-frontend-editor-unavailable
Unescaped message mobile-frontend-footer-sitename
Unescaped message mobile-frontend-copyright (might be obsolete?)

== Unsorted ==

Double escaped message scribunto-common-nosuchmodule
Unescaped message ajaxlogin-create
Unescaped message articlefeedbackv5-special-count-total
Unescaped message bibmanagercreate
Unescaped message bibmanagerimport
Unescaped message browsesw
Unescaped message categorytree-empty-bullet
Unescaped message colon‐separator
Unescaped message gwtoolset-ensure-well-formed-xml
Unescaped message linkedwiki-specialsparqlquery_endpointsparql
Unescaped message linkedwiki-specialsparqlquery_sendquery
Unescaped message login
Unescaped message massaction-newtask (patch)
Unescaped message massaction-viewtask (patch)
Unescaped message pagedisqus-noscript
Unescaped message pagedisqus-title
Unescaped message pagetriage-welcome
Unescaped message scribunto‐limitreport‐memusage
Unescaped message scribunto‐limitreport‐memusage‐value
Unescaped message scribunto‐limitreport‐timeusage
Unescaped message scribunto‐limitreport‐timeusage‐value
Unescaped message size‐megabytes
Unescaped message tags-create-explanation
Unescaped message wikibase‐limitreport‐entities‐accessed
Unescaped message wikimedia-copyright
Unescaped message yourname
Unescaped message yourpassword

Details

SubjectRepoBranchLines +/-
Escape text in Linker::specialLink()mediawiki/coremaster+1 -1
Escape twnmp-bannerwhomediawiki/extensions/TwnMainPagemaster+1 -1
Escape messagesmediawiki/extensions/InviteSignupmaster+7 -7
Escape extra input messages on Special:UserLogin/signupmediawiki/coremaster+1 -1
Add release-notes for message escapingmediawiki/coremaster+4 -0
Escape message editsection on action=viewmediawiki/coremaster+1 -1
Escape message 'redirectto' in Articlemediawiki/coremaster+1 -1
Escape unescaped messages in Special:Askmediawiki/extensions/SemanticMediaWikimaster+22 -22
Escape messages on Special:Nukemediawiki/extensions/Nukemaster+7 -6
Escape message parentheses on Special:Gadgetsmediawiki/extensions/Gadgetsmaster+2 -1
Escape unsafe messages in CategoryViewer.phpmediawiki/coremaster+12 -6
Escape message 'version-poweredby-others' on Special:Versionmediawiki/coremaster+3 -3
Avoid double escaped expiry time on action=protectmediawiki/coremaster+1 -3
Escape all return values from ProtectedPagesPager::formatValuemediawiki/coremaster+6 -4
Fully escape return value from FileDuplicateSearchPage::formatResultmediawiki/coremaster+5 -4
Escape return value from Skin::getUndeleteLinkmediawiki/coremaster+2 -2
Avoid double escaped message 'nbytes' on Special:NewPagesmediawiki/coremaster+4 -4
Escape unescaped messages in Special:CreateClassmediawiki/extensions/SemanticFormsmaster+16 -12
Escape value returned by SpecialPage::getDescription()mediawiki/coremaster+1 -1
Escape unescaped messages in Special:Askmediawiki/extensions/SemanticMapsmaster+2 -2
Escape unescaped messages in Special:AdminLinksmediawiki/extensions/AdminLinksmaster+17 -7
Escape unescaped messages in Special:Preferencesmediawiki/coremaster+16 -18
Remove double escaping of group member name on Special:ListUsersmediawiki/coremaster+1 -1
Show related patches Customize query in gerrit

Related Objects
Search...

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
gerritbot added a comment.Mar 29 2015, 3:25 AM

Change 193562 merged by jenkins-bot:
Add release-notes for message escaping

https://gerrit.wikimedia.org/r/193562

Umherirrender mentioned this in rMWebaddbfd2bfd: Add release-notes for message escaping.Mar 29 2015, 3:26 AM
gerritbot added a comment.Jul 2 2015, 6:52 AM

Change 222252 had a related patch set uploaded (by Nikerabbit):
Escape messages

https://gerrit.wikimedia.org/r/222252

Krinkle renamed this task from Special pages, actions and views whose messages don't escape HTML to Special pages, actions and views whose messages don't escape text.Jul 9 2015, 12:05 PM
Krinkle updated the task description. (Show Details)
Yaron_Koren added subscribers: Nemo_bis, Yaron_Koren.Jul 10 2015, 11:09 AM

@Nikerabbit or @Nemo_bis - thank you for this comprehensive list. I'm confused about one item in the "SMW/SF" section, though - the very first one:

/w/i.php?title=User:Nike&action=formedit summary

The 'summary' message is called in SF's /includes/SF_FormUtils.php, and there the two relevant lines are:

$label = wfMessage( 'summary' )->text();

Html::element( 'label', array( 'for' => 'wpSummary' ), $label ) );

I would think that the element() call does the necessary escaping; is that not true?

Nikerabbit added a comment.EditedJul 10 2015, 11:15 AM

Maybe it is already fixed but nobody updated the bug? Currently on that URL I only see this:
Notice: Unescaped message sf-formedit-donotuseform in /www/dev.translatewiki.net/docroot/w/includes/OutputPage.php on line 2332

And
/wiki/Special:FormEdit/Support/User:Nike sf_formedit_formwarning

Nikerabbit updated the task description. (Show Details)Jul 10 2015, 11:27 AM
gerritbot added a comment.Jul 10 2015, 12:08 PM

Change 224053 had a related patch set uploaded (by Nikerabbit):
Escape twnmp-bannerwho

https://gerrit.wikimedia.org/r/224053

Yaron_Koren added a comment.Jul 10 2015, 1:52 PM

@Nikerabbit - thanks for the information. I just checked in two patches that hopefully take care of all the unescaped messages in Semantic Forms:

https://git.wikimedia.org/commitdiff/mediawiki%2Fextensions%2FSemanticForms/5036b8aaec70ec67db060483b1ceb5c7bbf85353
https://git.wikimedia.org/commitdiff/mediawiki%2Fextensions%2FSemanticForms/6ac1afb837d13cb82f5adb3db0bc98ed81c25842

gerritbot added a comment.Jul 10 2015, 8:00 PM

Change 222252 merged by jenkins-bot:
Escape messages

https://gerrit.wikimedia.org/r/222252

Nikerabbit mentioned this in rMEXT6d9004acffe7: Updated mediawiki/extensions Project: mediawiki/extensions/InviteSignup….Jul 10 2015, 8:01 PM
Nikerabbit mentioned this in rEIVS21a90932dd09: Escape messages.Jul 10 2015, 9:43 PM
Nemo_bis updated the task description. (Show Details)Jul 11 2015, 1:59 PM
gerritbot added a comment.Jul 22 2015, 8:29 PM

Change 224053 merged by jenkins-bot:
Escape twnmp-bannerwho

https://gerrit.wikimedia.org/r/224053

Diffusion mentioned this in rMEXT7864d382bfd8: Updated mediawiki/extensions Project: mediawiki/extensions/TwnMainPage….Jul 22 2015, 8:29 PM
Nikerabbit mentioned this in rETWNe2f6b59b5071: Escape twnmp-bannerwho.Jul 22 2015, 8:39 PM
Nikerabbit updated the task description. (Show Details)Jul 22 2015, 8:42 PM
Yaron_Koren added a comment.Jul 23 2015, 1:26 AM

@Nikerabbit - did you forgot to remove "/wiki/Special:Forms sf_forms_docu" from the list? It's the last Semantic Forms message in there; and I'm pretty sure it's now escaped.

Nemo_bis updated the task description. (Show Details)Jul 23 2015, 9:26 AM
Yaron_Koren updated the task description. (Show Details)Jul 23 2015, 1:52 PM

I renamed the "SMW/SF" section to "Semantic MediaWiki".

Yaron_Koren added a comment.Jul 24 2015, 1:10 PM

I believe Replace Text's messages are now escaped - see here:

https://git.wikimedia.org/commitdiff/mediawiki%2Fextensions%2FReplaceText/72174c2fe00e0433b07f7bf574555860a9e23295

Yaron_Koren updated the task description. (Show Details)Jul 29 2015, 2:41 PM
Yaron_Koren removed projects: MediaWiki-extensions-ReplaceText, MediaWiki-extensions-Page_Forms.
Nemo_bis mentioned this in T2212: Some MediaWiki: messages not safe in HTML (tracking).Sep 10 2015, 7:31 AM
Nemo_bis added a comment.Sep 12 2015, 5:00 PM

So, I:

  • checked out https://gerrit.wikimedia.org/r/#/c/203299/ and set $wgDebugMessageEscaping = true; ;
  • enabled a bunch of extensions (P2014) on a web-inaccessible mediawiki-vagrant;
  • assigned all rights to unregistered users with foreach( User::getAllRights() as $right ) { $wgGroupPermissions['*'][$right] = true; };
  • attempted to open all special pages with curl http://localhost:8080/wiki/Special:SpecialPages > /tmp/SpecialPages.html; wget -O /dev/null -i /tmp/SpecialPages.html --force-html --base=http://localhost:8080/

I'll add the messages I get logged.

Nemo_bis updated the task description. (Show Details)Sep 12 2015, 5:01 PM
Nemo_bis added projects: PageTriage, UploadWizard, MassAction, MediaWiki-extensions-GWToolset.
Restricted Application added projects: Multimedia, Collaboration-Team-Triage. · View Herald TranscriptSep 12 2015, 5:02 PM
Restricted Application added a subscriber: Steinsplitter. · View Herald Transcript
Krenair awarded a token.Sep 12 2015, 8:18 PM
Restricted Application added a subscriber: Matanya. · View Herald TranscriptSep 12 2015, 8:18 PM
Nemo_bis updated the task description. (Show Details)Sep 13 2015, 10:53 AM
• Mattflaschen-WMF removed projects: Collaboration-Team-Triage, PageTriage.Sep 13 2015, 4:19 PM
• Mattflaschen-WMF subscribed.Sep 13 2015, 4:48 PM

Thanks very much for the report. Filed as T112469: Fix unsanitized message in PageTriage, and I put a patch up.

Yaron_Koren removed a project: MediaWiki-extensions-AdminLinks.Sep 14 2015, 1:07 AM
Yaron_Koren unsubscribed.
Jdforrester-WMF moved this task from Untriaged to Backlog on the Multimedia board.Sep 14 2015, 11:49 PM
Ricordisamoa subscribed.Sep 16 2015, 3:23 PM
Nemo_bis closed subtask T112469: Fix unsanitized message in PageTriage as Resolved.Sep 17 2015, 6:42 AM
matmarex mentioned this in T113669: Unescaped messages on Special:UploadWizard.Sep 24 2015, 9:53 PM
matmarex updated the task description. (Show Details)
matmarex removed projects: Multimedia, UploadWizard, Patch-For-Review.
Restricted Application added a project: Multimedia. · View Herald TranscriptSep 24 2015, 9:54 PM
Jdforrester-WMF closed subtask T113669: Unescaped messages on Special:UploadWizard as Resolved.Sep 29 2015, 4:06 PM
Addshore mentioned this in T120364: Fix unsanitized messages in MassAction.Dec 4 2015, 12:19 PM
Addshore added a subtask: T120364: Fix unsanitized messages in MassAction.
Restricted Application added a project: Commons. · View Herald TranscriptDec 4 2015, 12:19 PM
Addshore removed a project: MassAction.Dec 4 2015, 12:30 PM
zhuyifei1999 moved this task from Incoming to Backlog on the Commons board.Dec 5 2015, 5:01 AM
Nemo_bis added a subscriber: Google-Code-In-2015.Dec 12 2015, 6:35 PM

Can we add this to GCI? This was the description last year:

<p><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet">Escaping HTML is the first rule</a> for improving security against <a href="https://en.wikipedia.org/wiki/Cross-site_scripting">cross-site scripting</a> attacks, which have been the most common cybersecurity threat for years, causing billions dollars of damage. In this task, you will improve the security of MediaWiki by reducing its attack surface!</p>
<p>MediaWiki provides the <a href="https://www.mediawiki.org/wiki/Manual:Html.php">Html class</a> and <a href="https://www.mediawiki.org/wiki/Manual:Messages_API#Output_modes_and_escaping">i18n built-in escaping</a>, but some areas of the code don't use them correctly (or at all). You will help fixing them.</p>
<p>Pick one special page listed <a href="https://phabricator.wikimedia.org/T85864">in the issue tracker</a>; clone the code and check all the usages of the message keys listed next to its name; fix them and submit your patch in gerrit. The header tells the name of the repository; <a href="https://gerrit.wikimedia.org/r/#/q/topic:esc+owner:Nikerabbit,n,z">examples are available</a> of how your patches should look like.</p>
Nemo_bis added a project: Google-Code-In-2015.Dec 12 2015, 6:36 PM
Nemo_bis removed a subscriber: Google-Code-In-2015.
Aklapper added a comment.Dec 14 2015, 10:28 PM
In T85864#1875643, @Nemo_bis wrote:

Can we add this to GCI?

I'd guess so, but it would require mentor(s)...

Aklapper moved this task from Proposed to Mentors Required on the Google-Code-In-2015 board.Dec 14 2015, 10:28 PM
Nemo_bis added a comment.Jan 7 2016, 9:24 PM

@Nikerabbit, interested in mentoring?

Nikerabbit added a comment.Jan 8 2016, 2:17 AM

Until January 18th I cannot guarantee fast responds.

Liuxinyu970226 subscribed.Jul 24 2016, 10:13 PM
Restricted Application added a subscriber: Poyekhali. · View Herald TranscriptJul 24 2016, 10:13 PM
Jdforrester-WMF lowered the priority of this task from Medium to Lowest.Aug 4 2016, 11:33 PM
Jdforrester-WMF subscribed.

LiquidThreads has been replaced by StructuredDiscussions on all Wikimedia production wikis (except one, which will be done soon). It is no longer under active development or maintenance, so I'm re-classifying all open LQT tasks as "Lowest" priority.

Nemo_bis raised the priority of this task from Lowest to Medium.Aug 5 2016, 7:32 AM
• MZMcBride subscribed.Aug 11 2016, 1:54 PM
Nikerabbit mentioned this in T146416: Message -> string transformations should not affect each other.Sep 23 2016, 6:24 AM
Nikerabbit mentioned this in T151408: Separate bot right for normal pages and interface (MediaWiki:) pages.Nov 25 2016, 9:35 AM
Nemo_bis updated the task description. (Show Details)Nov 26 2016, 11:35 AM
Nikerabbit updated the task description. (Show Details)Nov 29 2016, 2:38 PM
matej_suchanek added a subtask: T26309: Some interface messages are broken if filter name contains template syntax.Dec 10 2016, 1:18 PM
Nemo_bis added a subtask: T152831: SmiteSpam has lots of HTML messages.Dec 11 2016, 4:07 PM
Mvolz closed subtask T152831: SmiteSpam has lots of HTML messages as Resolved.Dec 12 2016, 7:42 AM
zhuyifei1999 removed a project: Commons.Jan 27 2017, 4:21 PM
gerritbot added a comment.Mar 16 2017, 8:27 PM

Change 343117 had a related patch set (by Matěj Suchánek) published:
Escape text in Linker::specialLink()

https://gerrit.wikimedia.org/r/343117

gerritbot added a project: Patch-For-Review.Mar 16 2017, 8:27 PM
matej_suchanek updated the task description. (Show Details)Mar 16 2017, 8:49 PM
Nikerabbit removed a project: MediaWiki-extensions-TwnMainPage.Feb 14 2018, 9:00 AM
gerritbot added a comment.Jun 10 2018, 7:49 AM

Change 343117 merged by jenkins-bot:
[mediawiki/core@master] Escape text in Linker::specialLink()

https://gerrit.wikimedia.org/r/343117

matej_suchanek removed a project: Patch-For-Review.Jun 10 2018, 7:59 AM
ReleaseTaggerBot added a project: MW-1.32-notes (WMF-deploy-2018-06-12 (1.32.0-wmf.8)).Jun 10 2018, 8:00 AM
Kizule closed subtask T120364: Fix unsanitized messages in MassAction as Declined.Dec 31 2018, 5:26 AM
Aklapper added a project: MediaWiki-extensions-General.Jan 25 2019, 6:21 PM
Kizule updated the task description. (Show Details)Nov 11 2019, 1:05 AM
sbassett subscribed.Feb 18 2020, 5:26 PM
DannyS712 added projects: MediaWiki-extensions-RandomInCategory, MediaWiki-extensions-Gadgets, MediaWiki-extensions-Nuke, MediaWiki-extensions-AdminLinks, MediaWiki-extensions-SemanticMaps, MediaWiki-extensions-InviteSignup, MediaWiki-extensions-TwnMainPage.Mar 15 2020, 4:17 AM
sbassett mentioned this in T135591: Linker::specialLink() does not escape the link text.May 6 2020, 4:38 AM
Nikerabbit removed projects: MediaWiki-extensions-TwnMainPage, MediaWiki-extensions-InviteSignup.May 6 2020, 1:49 PM

Not sure why these tags were added. It does not help me to see this open task on the board if there is nothing actionable.

How about we close this task? The list given is likely outdated already.

Peachey88 closed this task as Resolved.Oct 4 2021, 3:07 AM
Peachey88 subscribed.

Closing per @Nikerabbit

If the list is ever refreshed, Individual tasks can be filed for each extension which will make the task a lot more manageable.

Jdforrester-WMF changed the task status from Resolved to Invalid.Oct 4 2021, 6:15 PM

That would be "Invalid" or "Declined", not "Resolved" then. :-)

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits