Skip to content
Permalink
Browse files Browse the repository at this point in the history
SECURITY: Parse tag function input as wikitext to prevent XSS
Unlike parser functions, tag functions' output is unescaped by
default.

Bug: T200973
Change-Id: I63ea5b7b1edd96a4b9fe8837eb7979faa80b5f78
  • Loading branch information
Nikerabbit committed Aug 6, 2018
1 parent a90495a commit b4bc3cb
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 9 deletions.
19 changes: 11 additions & 8 deletions I18nTags_body.php
Expand Up @@ -9,20 +9,22 @@ public static function onParserFirstCallInit( Parser $parser ) {
$parser->setFunctionHook( 'languagename', [ __CLASS__, 'languageName' ] );
}

public static function formatNumber( $data, $params, $parser ) {
public static function formatNumber( $data, $params, $parser, $frame ) {
$lang = self::languageObject( $params );

return $lang->formatNum( $data );
$text = $lang->formatNum( $data );
return $parser->recursiveTagParse( $text, $frame );
}

public static function grammar( $data, $params, $parser ) {
public static function grammar( $data, $params, $parser, $frame ) {
$case = isset( $params['case'] ) ? $params['case'] : '';
$lang = self::languageObject( $params );

return $lang->convertGrammar( $data, $case );
$text = $lang->convertGrammar( $data, $case );
return $parser->recursiveTagParse( $text, $frame );
}

public static function plural( $data, $params, $parser ) {
public static function plural( $data, $params, $parser, $frame ) {
list( $from, $to ) = self::getRange( isset( $params['n'] ) ? $params['n'] : '' );
$args = explode( '|', $data );
$lang = self::languageObject( $params );
Expand All @@ -41,10 +43,10 @@ public static function plural( $data, $params, $parser ) {
);
}

return $s;
return $parser->recursiveTagParse( $s, $frame );
}

public static function linktrail( $data, $params, $parser ) {
public static function linktrail( $data, $params, $parser, $frame ) {
$lang = self::languageObject( $params );
$regex = $lang->linkTrail();

Expand All @@ -60,7 +62,8 @@ public static function linktrail( $data, $params, $parser ) {
}
$predata = isset( $predata[2] ) ? $predata[2] : isset( $predata[1] ) ? $predata[1] : $predata[0];

return "<strong>$predata$inside</strong>$data";
$text = "<strong>$predata$inside</strong>$data";
return $parser->recursiveTagParse( $text, $frame );
}

public static function languageName( &$parser, $code = '', $outputLanguage = '' ) {
Expand Down
2 changes: 1 addition & 1 deletion extension.json
@@ -1,6 +1,6 @@
{
"name": "Parser i18n tags",
"version": "2016-02-20",
"version": "2018-08-06",
"author": "Niklas Laxström",
"url": "https://www.mediawiki.org/wiki/Extension:I18nTags",
"descriptionmsg": "i18ntags-desc",
Expand Down

0 comments on commit b4bc3cb

Please sign in to comment.