Last modified: 2013-01-23 16:34:01 UTC
Created attachment 10320 [details] patch to rm markers from arguments to url functions. [See bug 35315] Sorry i didn't notice this earlier, before the recent security release. The url functions get rid of the U+007f (since its a control character). Once that happens, padleft et all can be used to manipulate the strip marker and find Parser::randomString's output. The example exploit from bug 35315 modified to use the url functions (and assuming presence of wikipedia's crazy string manipulation library) would look like: <nowiki>','',''); alert("XSS",')</nowiki> {{#tag:charinsert|{{str_right|{{str_left|{{fullurl:foo|<nowiki/>}}|70}}|42}}00000002-QINU}} (Of course this no longer works given the patch to charinsert, but it seems bad in general to allow people to manipulate these markers.) The fix for this is of course just adding the killMarkers to the url function, patch attached.
Lua allows people to mess with strip markers in a more general way, but my review of the issue in that context concluded that the things that can go wrong are pretty minor. I fixed the infinite loop issue, so that we could allow Lua to modify strip markers. So I'm marking this as not a security issue.
(In reply to comment #0) > Created attachment 10320 [details] > patch to rm markers from arguments to url functions. bawolff: If the patch still makes sense it would probably be good to get this into Gerrit.
Tim did something similar in 13b514edaec25ff24c
