Last modified: 2013-10-29 11:36:51 UTC
MediaWiki has already a framework for whitelists for image urls via MediaWiki system pages. /** If $wgAllowExternalImages is false, you can allow an on-wiki * whitelist of regular expression fragments to match the image URL * against. If the image matches one of the regular expression fragments, * The image will be displayed. * * Set this to true to enable the on-wiki whitelist (MediaWiki:External image whitelist) * Or false to disable it */ $wgEnableImageWhitelist = true;
implementation tip: see core/includes/Parser/Parser.php if ( !$text && $this->mOptions->getEnableImageWhitelist() && preg_match( self::EXT_IMAGE_REGEX, $url ) ) { $whitelist = explode( "\n", wfMessage( 'external_image_whitelist' )->inContentLanguage()->text() ); foreach ( $whitelist as $entry ) { # Sanitize the regex fragment, make it case-insensitive, ignore blank entries/comments if ( strpos( $entry, '#' ) === 0 || $entry === '' ) { continue; } if ( preg_match( '/' . str_replace( '/', '\\/', $entry ) . '/i', $url ) ) { # Image matches a whitelist entry $text = Linker::makeExternalImage( $url ); break; } }
*** Bug 55940 has been marked as a duplicate of this bug. ***
The summary is completely incomprehensible for me, but according to what you said on bug 45857 this blocks bug 56287.
(In reply to comment #3) > The summary is completely incomprehensible for me, Harmonization of "whitelist" handling inside the extension RSS (in other words: E:RSS should use same code and syntax as MediaWiki core does for $wgEnableImageWhitelist) >but according to what you > said on bug 45857 this blocks bug 56287. Yes
What is the security threat model for rss whitelisting anyways? Mostly asking from a curiosity pov, but also one should make sure the threat models are compatible before copying the image whitelist from core.
(In reply to comment #5) > What is the security threat model for rss whitelisting anyways? Mostly asking > from a curiosity pov, but also one should make sure the threat models are > compatible before copying the image whitelist from core. The whitelist method was introduced long time ago, requested by Brion, as far as I remember, because RSS should only be included from trusted sources. Brion, pls. can you comment on that?
