Last modified: 2013-06-05 14:02:24 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T50802, the corresponding Phabricator task for complete and up-to-date bug report information.
First Last Prev Next    This bug is not in your last search results.
Bug 48802 - formatNum output should be escaped
formatNum output should be escaped
Status: NEW
Product: MediaWiki
Classification: Unclassified
General/Unknown (Other open bugs)
1.22.0
All All
: Low minor (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks: code_quality
  Show dependency tree / graph
 
Reported: 2013-05-25 09:27 UTC by Michał Zieliński
Modified: 2013-06-05 14:02 UTC (History)
9 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Michał Zieliński 2013-05-25 09:27:55 UTC 
formatNum output is not escaped in many places in MediaWiki, but as Nikerabbit suggested formatNum doesn't necessarily return escaped string. Although there is no language that uses <, > or & as digit or digit separator, we should either escape formatNum or check if there are no special characters in language file (separatorTransformTable, digitTransformTable).
Comment 1 Niklas Laxström 2013-05-25 09:30:22 UTC 
Regarding the process, we need a clear criteria when this bug can be closed, for example a list of all offending cases (keeping in mind that not all formatNum calls are for html output).
Comment 2 Bawolff (Brian Wolff) 2013-06-05 14:02:24 UTC 
(In reply to comment #0)
> formatNum output is not escaped in many places in MediaWiki, but as
> Nikerabbit
> suggested formatNum doesn't necessarily return escaped string. Although there
> is no language that uses <, > or & as digit or digit separator, we should
> either escape formatNum or check if there are no special characters in
> language
> file (separatorTransformTable, digitTransformTable).

Just to clarify, this is referring to html escaping, not wikitext escaping. (Just reading the bug title made me think this was like the issue with a pagename starting with a *).
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.

Navigation
Links