Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
wiki.techinc.nl/includes/parser
History
C. Scott Ananian 94f193a894 SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 
CVE-2025-32699

Ensure that Unicode NFC normalization can be applied to our HTML
output safely.  Even though the W3C officially recommends against
normalizing HTML

https://www.w3.org/International/questions/qa-html-css-normalization#converting

this is still easily done inadvertently, especially when using the
MediaWiki action API which normalizes parameters and results by
default.

See also I671648603c4635a35585c860b4857f5ea085e47f in Parsoid, and
T266140 / I2e78e660ba1867744e34eda7d00ea527ec016b71 for another similar
issue.

The following changes are made:

* The various HTML serializers (Remex/Tidy-derived, as well as the
  Html::* helpers) are tweaked to entity-escape U+0338 wherever it
  appears.

* Similarly, Message::escaped() is tweaked to entity-escape U+0338.

* Finally, a post-processing pass is added to the OutputTransform
  pipeline to catch any remaining U+0338 and entity-escape them.
  This catches U+0338 added during any of the previous OutputTransform
  stages (like TOC insertion, section edit links, etc).
  *When backporting* this code will likely need to be moved to
  ParserOutput::getText(), as the OutputTransform pipeline wasn't added
  until MW 1.42.

Bug: T387130
Change-Id: I66564e14e730f5393f4fa5780b80f24de6075af5
2025-04-10 15:56:06 +01:00
..
Hook Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
Parsoid Merge "Deprecate ::setMetrics() calls with StatsdDataFactoryInterface" 2024-10-21 17:12:19 +00:00
BlockLevelPass.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
CacheTime.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
CoreMagicVariables.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
CoreParserFunctions.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
CoreTagHooks.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
DateFormatter.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
DateFormatterFactory.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
LinkHolderArray.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
MagicWord.php MagicWord::replace*: Make sure we don't pass null into preg_match/preg_replace 2025-03-17 14:19:01 +00:00
MagicWordArray.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
MagicWordFactory.php parser: Add a new {{USERLANGUAGE}} magic word for use in wikitext 2024-09-07 19:16:32 +00:00
MWTidy.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
Parser.php parser: Increment expensive function count for special page transclusion 2024-10-18 14:36:48 +00:00
ParserCache.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
ParserCacheFactory.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
ParserCacheFilter.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
ParserCacheMetadata.php
ParserFactory.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
ParserObserver.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
ParserOptions.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
ParserOutput.php ParserOutput::getExternalLinks(): Deprecate use of the internal array reference 2024-10-22 16:33:27 -04:00
ParserOutputFlags.php
ParserOutputLinkTypes.php ParserOutput: Introduce ParserOutput::getLinkList() 2024-10-18 13:24:10 -04:00
ParserOutputStringSets.php
PPCustomFrame_Hash.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPDPart_Hash.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPDStack_Hash.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPDStackElement_Hash.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPFrame.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPFrame_Hash.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPNode.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPNode_Hash_Array.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPNode_Hash_Attr.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPNode_Hash_Text.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPNode_Hash_Tree.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
PPTemplateFrame_Hash.php Namespace all remaining classes in includes/parser 2024-10-15 23:54:32 +01:00
Preprocessor.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
Preprocessor_Hash.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
RemexRemoveTagHandler.php
RemexStripTagHandler.php parser: Add missing documentation to class properties 2024-09-07 22:46:08 +02:00
RevisionOutputCache.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00
Sanitizer.php SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 2025-04-10 15:56:06 +01:00
StripState.php Use explicit nullable type on parameter arguments 2024-10-16 20:58:33 +02:00