5f21cc528e
CVE-2025-61638
Previously, if you managed to get data- attributes with e.g spaces or
slashes in the name into validateAttributes(), then the rest of the
attribute name would not be validated and get concatenated into HTML
that would eventually be parsed as separate attributes (or even tag
contents and new markup, if you had a > in the name). I don’t think this
was possible via regular <p> parsing, as decodeTagAttributes() would
decode the attributes differently in that case, but it was possible via
various wikitext constructs, including {{#tag:}}.
Tighten the regex to throw out such invalid attributes, and add a few
tests in this direction. More refactoring, and especially more tests,
can happen later, once this chaneg is public and we can benefit from CI.
Bug: T401099
Change-Id: Id095a3278083dbedba083d5aa3c1cbaa379a682f
Co-Authored-By: Lucas Werkmeister <lucas.werkmeister@wikimedia.de>
|
||
|---|---|---|
| .. | ||
| data | ||
| docs | ||
| includes | ||
| integration/includes | ||
| maintenance | ||
| mocks | ||
| structure | ||
| suites | ||
| tests | ||
| unit | ||
| bootstrap.common.php | ||
| bootstrap.integration.php | ||
| bootstrap.maintenance.php | ||
| bootstrap.php | ||
| DynamicPropertyTestHelper.php | ||
| getPHPUnitExtensionsAndSkins.php | ||
| HamcrestPHPUnitIntegration.php | ||
| JsonSchemaAssertionTrait.php | ||
| MediaWikiCoversValidator.php | ||
| MediaWikiDeprecatedConfigPHPUnitExtension.php | ||
| MediaWikiGroupValidator.php | ||
| MediaWikiIntegrationTestCase.php | ||
| MediaWikiLangTestCase.php | ||
| MediaWikiLoggerPHPUnitExtension.php | ||
| MediaWikiPHPUnitResultPrinter.php | ||
| MediaWikiTeardownPHPUnitExtension.php | ||
| MediaWikiTestCaseTrait.php | ||
| MediaWikiUnitTestCase.php | ||
| MWTestDox.php | ||
| phpunit.php | ||
| README.md | ||
| ResourceLoaderTestCase.php | ||
| suite.xml | ||
| TestSelectQueryBuilder.php | ||
MediaWiki PHPUnit tests
WARNING: Integration tests may be destructive and alter or remove parts of your local database. We try to use temporary tables where possible, but you must never run tests on a production server or on a wiki where you don't want to lose data.
Running tests
If you haven't already, run composer update (specifically without --no-dev) in the MediaWiki core directory. This will install PHPUnit.
To read about how to run specific tests, refer to:
https://www.mediawiki.org/wiki/Manual:PHP_unit_testing/Running_the_tests
Writing tests
A guide to writing PHPUnit tests for MediaWiki can be found at: