Mglaser has uploaded a new change for review.
https://gerrit.wikimedia.org/r/180559
Change subject: SECURITY: validate URL added to listings
......................................................................
SECURITY: validate URL added to listings
Ensure listings urls are valid, and not "javascript:", etc.
Use Html::element instead of rawElement when displaying name.
Bug: T77624
Change-Id: If23d7dfa8ef04cd5fd00823dfa55b017cedd5336
---
M Listings.body.php
1 file changed, 10 insertions(+), 4 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/Listings
refs/changes/59/180559/1
diff --git a/Listings.body.php b/Listings.body.php
index 6f4a873..cba597e 100644
--- a/Listings.body.php
+++ b/Listings.body.php
@@ -203,12 +203,18 @@
}
// @fixme: a lot of localisation-unfriendly patchwork below
- $out = Html::rawElement( 'strong', array(), $name );
+ $out = Html::element( 'strong', array(), $name );
if ( $url != '' ) {
- $out = Html::rawElement( 'a',
- array( 'href' => $url, 'class' => 'external
text', 'rel' => 'nofollow', 'title' => $name ),
- $out
+ $sanitizedHref = Sanitizer::validateAttributes(
+ array( 'href' => $url ),
+ array( 'href' )
);
+ if ( isset( $sanitizedHref['href'] ) ) {
+ $out = Html::rawElement( 'a',
+ $sanitizedHref + array( 'class' =>
'external text', 'rel' => 'nofollow', 'title' => $name ),
+ $out
+ );
+ }
}
if ( $alt != '' ) {
// @todo FIXME: i18n issue (hard coded parentheses)
--
To view, visit https://gerrit.wikimedia.org/r/180559
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: If23d7dfa8ef04cd5fd00823dfa55b017cedd5336
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/Listings
Gerrit-Branch: REL1_22
Gerrit-Owner: Mglaser <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
