SECURITY: escape section labels in HTMLMultiSelectField

CVE-2025-3469

Only use HtmlSnippet when the labels are not coming from a message, to
avoid XSS-via-i18n vulnerabilities.

Bug: T358689
Change-Id: If91500bc76b3ed8cdc58da4f9de326df6d201398

includes/htmlform/fields/HTMLMultiSelectField.php

@@ -230,10 +230,13 @@ class HTMLMultiSelectField extends HTMLFormField implements HTMLNestedFilterable
 
 			$widget = new \OOUI\CheckboxMultiselectInputWidget( $attr );
 			if ( $sectionLabel ) {
+				if ( $this->mOptionsLabelsNotFromMessage ) {
+					// @phan-suppress-next-line SecurityCheck-XSS Can't track conditional escaping via a property
+					$sectionLabel = new \OOUI\HtmlSnippet( $sectionLabel );
+				}
 				$out[] = new \OOUI\FieldsetLayout( [
 					'items' => [ $widget ],
-					// @phan-suppress-next-line SecurityCheck-XSS Key is html, taint cannot track that
-					'label' => new \OOUI\HtmlSnippet( $sectionLabel ),
+					'label' => $sectionLabel,
 				] );
 			} else {
 				$out[] = $widget;