On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is acheived using the wikitext {{SHORTDESC:<img src=x onerror=alert()>}}. This is due to the function sanitize() in ParserHooks.php which returns trim( html_entity_decode( strip_tags( $shortDesc ), ENT_QUOTES, 'utf-8' ) ); This strips HTML tags, of which there are none in the payload due to being encoded representations, and then the encoded entities are decoded to the actual characters. It's not clear to me why html_entity_decode is called or what this function is trying to achieve, I think it makes more sense to just do trim( htmlspecialchars( $shortDesc );. Note: this won't apply retroactively to page props that already exist in the DB, so it wouldn't fix the vulnerability in the case that someone had already exploited it.
Description
Event Timeline
The extension has been disabled temporarily until it is patched and further steps can be taken. Thank you for the report.
Thanks for letting me know!
The original sanitization code came from the Wikibase extension.
html_entity_decode is called because clients are not necessarily HTML-based and using HTML tags as part of the description (i.e. with <nowiki> or such) should be possible.
I can do the sanitization on the JS side but I am not sure how to approach it with the page props table. Would you have some suggestion on it?
I see. This should be fine then, escapes the use on the page and in the info action. I don't think it's output unescaped anywhere else.
diff --git a/includes/Hooks/ActionsHooks.php b/includes/Hooks/ActionsHooks.php index 053b75d..9109e46 100644 --- a/includes/Hooks/ActionsHooks.php +++ b/includes/Hooks/ActionsHooks.php @@ -32,7 +32,7 @@ class ActionsHooks implements InfoActionHook { $pageInfo['header-basic'][] = [ $context->msg( 'shortdescription-info-label' ), - $shortdesc + htmlspecialchars( $shortdesc ) ]; } } diff --git a/modules/ext.shortDescription.js b/modules/ext.shortDescription.js index f6e1d33..6cc87c7 100644 --- a/modules/ext.shortDescription.js +++ b/modules/ext.shortDescription.js @@ -7,7 +7,7 @@ function main() { // Wikipedia uses shortdescription class // Added for gadgets and extension compatibility tagline.classList.add( 'ext-shortdesc', 'shortdescription' ); - tagline.innerHTML = shortdesc; + tagline.innerHTML = mw.html.escape( shortdesc ); } }
This needs to be fixed upstream and since there's nothing further that can be done by Miraheze I don't see why it should be High priority.
Re-enabled extension. Thank you for this report. If there are no objections (@Alistair3149?) this task could be made public.