Last modified: 2012-04-12 13:54:49 UTC
Security researcher mghack discovered a CSS injection vulnerability. Incorrect parsing of CSS comments allows dangerous tokens such as expression() and url() to be passed through to the browser. The vulnerability affects all previous versions of MediaWiki. A fix will be released shortly in MediaWiki 1.16.2. If patches are available for earlier major versions, it will be noted in a comment below. Our fix involves: * A patch to StringUtils::delimiterReplaceCallback() which fixes the logic error. * A patch to Sanitizer::checkCss() which removes any remaining comment-start tokens, thus preventing any possible confusion over their interpretation. Either of these patches would have fixed the problem alone. This vulnerability was originally reported to the Mozilla Security Group and has been assigned CVE-2011-0047.
Fixed in r81332
Since CodeReview only tags forward and not backwards with common "bug #" in the commit message, also naming the following revision in which it was fixed in trunk: r81330 trunk r81331 1.17 r81332 1.16 r 81333 1.15
