Last modified: 2013-06-05 14:02:24 UTC

Wikimedia Bugzilla is closed!

Wikimedia has migrated from Bugzilla to Phabricator. Bug reports should be created and updated in Wikimedia Phabricator instead. Please create an account in Phabricator and add your Bugzilla email address to it.
Wikimedia Bugzilla is read-only. If you try to edit or create any bug report in Bugzilla you will be shown an intentional error message.
In order to access the Phabricator task corresponding to a Bugzilla report, just remove "static-" from its URL.
You could still run searches in Bugzilla or access your list of votes but bug reports will obviously not be up-to-date in Bugzilla.
Bug 48802 - formatNum output should be escaped
formatNum output should be escaped
Status: NEW
Product: MediaWiki
Classification: Unclassified
General/Unknown (Other open bugs)
1.22.0
All All
: Low minor (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks: code_quality
  Show dependency treegraph
 
Reported: 2013-05-25 09:27 UTC by Michał Zieliński
Modified: 2013-06-05 14:02 UTC (History)
9 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Michał Zieliński 2013-05-25 09:27:55 UTC
formatNum output is not escaped in many places in MediaWiki, but as Nikerabbit suggested formatNum doesn't necessarily return escaped string. Although there is no language that uses <, > or & as digit or digit separator, we should either escape formatNum or check if there are no special characters in language file (separatorTransformTable, digitTransformTable).
Comment 1 Niklas Laxström 2013-05-25 09:30:22 UTC
Regarding the process, we need a clear criteria when this bug can be closed, for example a list of all offending cases (keeping in mind that not all formatNum calls are for html output).
Comment 2 Bawolff (Brian Wolff) 2013-06-05 14:02:24 UTC
(In reply to comment #0)
> formatNum output is not escaped in many places in MediaWiki, but as
> Nikerabbit
> suggested formatNum doesn't necessarily return escaped string. Although there
> is no language that uses <, > or & as digit or digit separator, we should
> either escape formatNum or check if there are no special characters in
> language
> file (separatorTransformTable, digitTransformTable).

Just to clarify, this is referring to html escaping, not wikitext escaping. (Just reading the bug title made me think this was like the issue with a pagename starting with a *).

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links