https://bugzilla.wikimedia.org/show_bug.cgi?id=46443
Web browser: ---
Bug ID: 46443
Summary: Sanitizer fails to (extra-) include image tags: if
these are incorrectly written as closed tags <img src=
/>
Product: MediaWiki
Version: 1.21-git
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: Unprioritized
Component: Parser
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Classification: Unclassified
Mobile Platform: ---
Copied from the description of bug 35002 :
I noticed that the Sanitizer function fails in the cases where the image tag is
written in XHMTL-style as a closed tag <img src='http://image-url' />".
The net is full of reports of such things (XHTML vs. HTML4.1 vs. HTML5)
read for example this
http://tiffanybbrown.com/2011/03/23/html5-does-not-allow-self-closing-tags/ .
This is still a valid bug, and a big problem for my RSS extension if the
adminstrator expressly allows the rendering of <img> tags.
In this case the Sanitizer is called as usual but gets additional food:
$extraInclude[] = "img";
==> but *fails* to allow the img, escapes it still, which is wrong in that case
<===
In other words, and to make it unambiguously clear:
The sanitizer does still its work and sanitizes (fallback: it is still secure),
even if you want it *not* to santize img tags.
Because I have no influence on the composition of images tags of the incoming
source (RSS feed), and some of these source do not obey the rules for image
tags, I ask the MediaWiki Sanitizer specialist to fix this specific problem of
"closed image tags".
How to reproduce:
================================================
(excerpt and comnstructed example; part of E:RSS)
$extraInclude = array();
$extraExclude = array( "iframe" );
$extraInclude[] = "a";
$extraInclude[] = "img";
$text = '<img
src="http://tctechcrunch2011.files.wordpress.com/2013/03/yodlee_logo_final_rgb_lrg.jpg";>';
$ret = Sanitizer::removeHTMLtags( $text, null, array(), $extraInclude,
$extraExclude );
wfDebug( "RSS: after Sanitizer::removeHTMLtags:text:" . print_r( $text, true )
. "\n" );
wfDebug( "RSS: after Sanitizer::removeHTMLtags:extraInclude: " . print_r(
$extraInclude, true ) . "\n" );
wfDebug( "RSS: after Sanitizer::removeHTMLtags:extraExclude: " . print_r(
$extraExclude, true ) . "\n" );
wfDebug( "RSS: after Sanitizer::removeHTMLtags:ret: " . print_r( $ret, true ) .
"\n" );
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
![http://tctechcrunch2011.files.wordpress.com/2013/03/yodlee_logo_final_rgb_lrg.jpg"](http://tctechcrunch2011.files.wordpress.com/2013/03/yodlee_logo_final_rgb_lrg.jpg"){kind=link}