https://bugzilla.wikimedia.org/show_bug.cgi?id=34308
Web browser: ---
Bug #: 34308
Summary: HTML/JS/XSS injection in visual editor (attribute
sanitation on links)
Product: MediaWiki extensions
Version: any
Platform: All
URL: https://test.wikipedia.org/wiki/Special:VisualEditorSa
ndbox
OS/Version: All
Status: NEW
Severity: normal
Priority: Unprioritized
Component: VisualEditor
AssignedTo: [email protected]
ReportedBy: [email protected]
CC: [email protected], [email protected]
Classification: Unclassified
Create a new link in the visual editor. Add this text as the link target
(including quotes exactly):
" onmouseover="alert(document.cookie)" alt=
When mousing over the link in the editor, you'll get an alert popup with cookie
contents. Same occurs in the HTML serialization ("preview").
I notice that ve.Html.makeAttributeList() doesn't do any escaping. Changing it
locally to escape the text before putting it into an attribute seems to help on
the preview (HTML serialization) but not in the editor.
--
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
