Last modified: 2013-09-05 17:05:28 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T55472, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 53472 - [WikibaseRepo] XSS: Labels shown in "In other languages" section of entity view are not escaped


Summary:	[WikibaseRepo] XSS: Labels shown in "In other languages" section of entity vi...

Status:	VERIFIED FIXED

Product:	MediaWiki extensions
Classification:	Unclassified
Component:	WikidataRepo (Other open bugs)
Version:	master
Hardware:	All All

Importance:	Unprioritized normal (vote)
Target Milestone:	---
Assigned To:	Wikidata bugs

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2013-08-28 13:01 UTC by Liangent
Modified:	2013-09-05 17:05 UTC (History)
CC List:	6 users (show)

See Also:
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Bugfix for the issue (1.77 KB, patch) 2013-08-28 13:15 UTC, Liangent	Details
htmlspecialchars( Utils::fetchLanguageName( $language ) ) too (1.87 KB, patch) 2013-08-28 16:12 UTC, Liangent	Details
Add an attachment (proposed patch, testcase, etc.)

Description Liangent 2013-08-28 13:01:56 UTC

Insert "<script>alert(1)</script>" in a label and when it's shown in the "In other languages" section, the script snippet is executed.

Comment 1 Liangent 2013-08-28 13:15:56 UTC

Created attachment 13188 [details]
Bugfix for the issue

Another less serious (can only be exploited by admins) XSS is address too.

Comment 2 Chris Steipp 2013-08-28 14:35:17 UTC

Thanks Liangent! That looks like a reasonable fix. Let me do some testing on it, and we'll get it deployed asap.

Comment 3 Liangent 2013-08-28 16:12:08 UTC

Created attachment 13189 [details]
htmlspecialchars( Utils::fetchLanguageName( $language ) ) too

It looks better for me to htmlspecialchars( Utils::fetchLanguageName( $language ) ) too, though Utils::fetchLanguageName() has a fixed set of outputs currently.

Comment 4 Chris Steipp 2013-08-28 18:37:56 UTC

Reviewed and tested by Aude too. Deployed.

18:37 logmsgbot: csteipp synchronized php-1.22wmf13/extensions/Wikibase
18:35 logmsgbot: csteipp synchronized php-1.22wmf14/extensions/Wikibase

I'll add into gerrit too.

Comment 5 Liangent 2013-08-28 20:09:57 UTC

I can confirm this is fixed live.

Comment 6 abraham.taherivand 2013-09-04 13:28:55 UTC

Verified in Wikidata demo time

Comment 7 Chris Steipp 2013-09-05 17:05:28 UTC

This was assigned CVE-2013-4307

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links