Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Treat File::getShortDesc() as possibly unsafe HTML

Browse source 
File::getShortDesc() is documented to return HTML, but some handlers
return unescaped plain text.

Bug: T395834
Change-Id: I150f0215339b4ac18254fce2be138b1cde2277d5
(cherry picked from commit b2a9cc1564397e27fd80e44e99e1905fcbd10684)
This commit is contained in:
Bartosz Dziewoński 2025-06-02 21:12:34 +02:00
parent 707e98bb1f
commit 994f95f757
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
includes/search/searchwidgets/FullSearchResultWidget.php
View file

@ -11,6 +11,7 @@ use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Html\Html;
use MediaWiki\Linker\LinkRenderer;
use MediaWiki\MainConfigNames;
use MediaWiki\Parser\Sanitizer;
use MediaWiki\Search\Entity\SearchResultThumbnail;
use MediaWiki\Search\SearchResultThumbnailProvider;
use MediaWiki\Specials\SpecialSearch;
@ -317,9 +318,14 @@ class FullSearchResultWidget implements SearchResultWidget {
return [ $html, null, $this->generateThumbnailHtml( $result ) ];
}
// File::getShortDesc() is documented to return HTML, but many handlers used to incorrectly
// return plain text (T395834), so sanitize it in case the same bug is present in extensions.
$unsafeShortDesc = $img->getShortDesc();
$shortDesc = Sanitizer::removeSomeTags( $unsafeShortDesc );
return [
$html,
$this->specialPage->msg( 'parentheses' )->rawParams( $img->getShortDesc() )->escaped(),
$this->specialPage->msg( 'parentheses' )->rawParams( $shortDesc )->escaped(),
$this->generateThumbnailHtml( $result, $thumbnail )
];
}