http://nickj.org/api.php?action=feedcontributions&user=125.46.23.82&feedformat=atomNick Jenkins - User contributions [en]2024-03-29T08:08:28ZUser contributionsMediaWiki 1.22.6http://nickj.org/MediaWikiMediaWiki2008-10-01T14:57:27Z<p>125.46.23.82: /* HTML Validation or PHP errors or SQL errors */</p>
<hr />
<div>Hello visitor! If you found this page, then you probably wanted something else. Here are links to what you're probably looking for:<br />
* Do you want information about a specific MediaWiki extension? Try [http://www.mediawiki.org/wiki/Extension_Matrix the table here] or [http://www.mediawiki.org/w/index.php?title=Category:All_extensions the multi-page list here], to help find the homepage for that extension.<br />
* Do you want information about MediaWiki itself? Try [http://www.mediawiki.org/ the website] for documentation, the [http://www.mediawiki.org/wiki/MediaWiki_on_IRC IRC channel] for quick questions, [http://www.mediawiki.org/wiki/Mailing_lists a mailing list] for more detailed questions, or the [http://en.wikipedia.org/wiki/MediaWiki MediaWiki Wikipedia article] for a timeline of past releases.<br />
* Do you want to hire MediaWiki developers or consultants? See [http://wikihr.net/MediaWiki the WikiHR site].<br />
<br />
Now back to your regularly scheduled programming....<br />
------<br />
<br />
Various MediaWiki 1.7.1 and extension parser tests, that fail HTML validation <s>and/or have potential security issues</s>. There is a [[:MediaZilla:5066|MediaWiki bug report]] covering this. Some were found by hand, but most of these were found by [http://www.cs.wisc.edu/~bart/fuzz/fuzz.html fuzz testing] of MediaWiki, using a modified PHP port of [http://www.securiteam.com/tools/6Z00N1PBFK.html the Python port] of [http://www.securityfocus.com/archive/1/378632/2004-10-15/2004-10-21/0 mangleme]. The [http://files.nickj.org/MediaWiki/wiki-mangleme.phps original source code is available], although the [http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/maintenance/fuzz-tester.php version now in the MediaWiki trunk] is much more current. Lastly, all the MediaWiki tests listed below are released into the public domain, and as such you're welcome to incorporate them into any software you like, under any license you like.<br />
<br />
Very interesting tale <a href=" Pthc ">Loli Hc Bbs</a> 705847<br />
<br />
Hello good day <a href=" indonesian lolitas ">little <br />
<br />
</a> 512<br />
<br />
== Completely fixed == <br />
<br />
Things belong here if they now give valid HTML, don't cause PHP errors/warnings or SQL errors/warnings, and don't cause Tidy warnings.<br />
<br />
{| border="1"<br />
! Test<br />
! Wiki Source<br />
! Validate HTML<br />
! Tidy HTML<br />
! [[#Definition of Security Aspects|Security<br>aspects?]]<br />
! Fixed in<br />
! Visible<br>Artefacts?<br />
! Notes and any extra info.<br />
|-<br />
| <s>[[MediaWiki/Parser7]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser7|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser7 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser7}}</s><br />
| No<br />
| 1.6.1<br />
| No.<br />
| Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.<br />
|-<br />
| <s>[[MediaWiki/Parser13]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser13|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser13 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser13}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.6<br />
| No.<br />
| <s>sDrops the '<a href="xxx' string. [http://mail.wikipedia.org/pipermail/wikitech-l/2006-April/034659.html Explanation for this + Parser14 + Parser14-table].</s> Completely fixed in 1.6.6.<br />
|-<br />
| <s>[[MediaWiki/Parser14]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser14|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser14 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser14}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.6<br />
| <s>Yes</s> No.<br />
| <s>TOC insertion</s> Completely fixed in 1.6.6.<br />
|-<br />
| <s>[[MediaWiki/Parser14-table]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser14-table|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser14-table W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser14-table}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.6<br />
| <s>Yes</s> No.<br />
| <s>TOC insertion</s> Completely fixed in 1.6.6.<br />
|-<br />
| <s>[[MediaWiki/Parser17]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser17|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser17 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser17}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.1<br />
| No.<br />
| Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.<br />
|-<br />
| <s>[[MediaWiki/Parser18]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser18|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser18 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser18}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.1<br />
| No.<br />
| Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.<br />
|-<br />
| <s>[[MediaWiki/Parser19]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser19|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser19 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser19}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.1<br />
| No.<br />
| Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.<br />
|-<br />
| <s>[[MediaWiki/Parser21]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser21|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser21 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser21}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.6<br />
| No.<br />
| Completely fixed in 1.6.6 - valid HTML, no artefacts, no tidy errors.<br />
|-<br />
| <s>[[MediaWiki/Parser22]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser22|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser22 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser22}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.6<br />
| No.<br />
| <s>Double links injection.</s> Completely fixed in 1.6.6 - valid HTML, no artefacts, no tidy errors.<br />
|-<br />
| <s>[[MediaWiki/Parser27]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser27|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser27 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser27}}</s><br />
| No.<br />
| r14480<br />
| No.<br />
| PHP warning in Sort extension, fixed in [http://mail.wikipedia.org/pipermail/mediawiki-cvs/2006-May/015460.html r14480].<br />
|-<br />
| <s>[[MediaWiki/Parser32]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser31|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser31 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser31}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.7<br />
| No.<br />
| [http://mail.wikipedia.org/pipermail/wikitech-l/2006-June/035974.html User-specified JavaScript execution]. Must be running an experimental extension, so most installations are<br />NOT affected. Wiki text not released yet. [http://mail.wikipedia.org/pipermail/mediawiki-cvs/2006-June/015491.html Fixed in trunk by r14511], and fixed in 1.6.7.<br />
|-<br />
| <s>[[MediaWiki/Parser35]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser35|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser35 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser35}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.7<br />
| No.<br />
| Limited attribute injection using CharInsert extension + Math extension.<br />
|-<br />
| <s>[[MediaWiki/Parser38]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser38|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser38 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser38}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.7<br />
| No.<br />
| Limited attribute injection using CharInsert extension + Cite extension.<br />
|-<br />
| <s>[[MediaWiki/Parser42]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser42|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser42 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser42}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.7<br />
| No.<br />
| Section heading abuse for gave Tidy error, strange page rendering, and a limited attribute injection.<br />
|-<br />
| <s>[[MediaWiki/Parser43]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser43|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser43 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser43}}</s><br />
| <s>Yes</s> No.<br />
| 1.6.7<br />
| No.<br />
| [http://mail.wikipedia.org/pipermail/wikitech-l/2006-June/036085.html XSS Arbitrary JavaScript execution and HTML insertion]. Fixed in 1.6.7 and fixed in [http://mail.wikipedia.org/pipermail/mediawiki-cvs/2006-June/015565.html r14585] for trunk.<br />
|-<br />
| <s>[[MediaWiki/Parser44]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser44|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser44 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser44}}</s><br />
| No.<br />
| r14733<br />
| No.<br />
| PHP warning in InputBox extension in E_ALL with bad input. [http://mail.wikipedia.org/pipermail/mediawiki-cvs/2006-June/015713.html Fixed in r14733].<br />
|-<br />
| <s>[[MediaWiki/Parser41]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser41|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser41 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser41}}</s><br />
| <s>Yes</s> No.<br />
| [http://mail.wikipedia.org/pipermail/mediawiki-cvs/2006-June/015524.html r14544]<br />
| No.<br />
| Wikitext of death (causes internal Parser error). Fixed in 1.7, but not in 1.6.<br />
|-<br />
| <s>[[MediaWiki/Parser48]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser48|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser48 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser48}}</s><br />
| <s>Yes</s> No.<br />
|<br />
| No.<br />
| $wgAllowExternalImages is enabled by default in 1.6 stable, but it is turned off in 1.7 and Trunk by default.<br />This can be abused on a 1.6 wiki to create a page which when viewed will log the user off.<br />
|-<br />
| <s>[[MediaWiki/Parser2]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser2|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser2 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser2}}</s><br />
| No<br />
|<br />
| No<br />
|-<br />
| <s>[[MediaWiki/Parser20]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser20|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser20 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser20}}</s><br />
| No<br />
|<br />
| No.<br />
| Nowiki allows malformed URI (e.g. generates multi-line hrefs). Passes W3C validation, but tidy gives warnings, and the<br>links don't act like normal links (in Firefox, at least) - clicking on them does nothing.<br />
|-<br />
| <s>[[MediaWiki/Parser23]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser23|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser23 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser23}}</s><br />
| No.<br />
|<br />
| No.<br />
| Pre allows malformed URI. Fails validation (unlike nowiki).<br />
|-<br />
| <s>[[MediaWiki/Parser45]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser45|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser45 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser45}}</s><br />
| No.<br />
| [http://mail.wikipedia.org/pipermail/mediawiki-cvs/2006-June/015710.html r14730]<br />
| <s>Yes</s> No.<br />
| PHP notices on the page history with bad input + E_ALL.<br />
|-<br />
| <s>[[MediaWiki/Parser46]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser46|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser46 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser46}}</s><br />
| No.<br />
|<br />
| <s>Yes</s> No.<br />
| Bad input on Page History that causes SQL error.<br />
|-<br />
| <s>[[MediaWiki/Parser50]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser50|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser50 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser50}}</s><br />
| No<br />
|<br />
| <s>Yes</s> No.<br />
| Gives PHP fatal error on bad input on Special:Userlogin<br />
|-<br />
| <s>[[MediaWiki/Parser47]]</s><br />
| <s>[[Special:Export/MediaWiki/Parser47|Export Wiki Source]]</s><br />
| <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser47 W3C Validator]</s><br />
| <s>{{tidy-html|page=MediaWiki/Parser47}}</s><br />
| No.<br />
|<br />
| <s>Yes</s> No.<br />
| Two PHP notices on Special:Contributions with bad input + E_ALL.<br />
|}<br />
<br />
==Logged in bugzilla==<br />
<br />
Lately most new things have [http://bugzilla.wikimedia.org/buglist.cgi?query_format=advanced&emailreporter1=1&emailtype1=substring&email1=nickj%40neverbox.com been logged in bugzilla], which makes them easier to track.<br />
<br />
There is a small amount of overlap between this page and bugzilla, namely for the following bugs:<br />
<br />
{| border="1"<br />
! Test<br />
! Wiki Source<br />
! Validate HTML<br />
! Tidy HTML<br />
! [[#Definition of Security Aspects|Security<br>aspects?]]<br />
! Fixed in<br />
! Visible<br>Artefacts?<br />
! Notes and any extra info.<br />
|-<br />
| [[MediaWiki/Parser51]]<br />
| [[Special:Export/MediaWiki/Parser51|Export Wiki Source]]<br />
| [http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser51 W3C Validator]<br />
| {{tidy-html|page=MediaWiki/Parser51}}<br />
| No<br />
|<br />
| bgcolor=grey | Yes<br />
| PHP warnings on malformed cookie session_id on Special:Userlogin. Also logged as [[:MediaZilla:6538]]<br />
|}<br />
<br />
==Definition of Security Aspects==<br />
<br />
For the above table, "security aspect" is defined as anything that causes the start of a tag to be missing, or the end to be missing, or attributes of any type that should not be there to be injected. For example:<br />
* ''&lt;p&gt;&lt;td&gt;&lt;s&gt;&lt;/p&gt;'' would '''not''' be considered to have a security aspect because all the tags are appearing ok (are not malformed), although it is invalid HTML.<br />
* ''<nowiki>&lt;a href="http://as&lt;td&gt;&lt;/td&gt;&lt;td class="external free"&gt;&lt;p&gt;user text here</nowiki>'' would be considered to have a security aspect because the "href" string is not properly terminated, and so the "external free" part is injected as attributes.<br />
* A string missing the start of a tag would also be considered to have a security aspect - e.g. ''<nowiki>&lt;th&gt;|||||" class="external free" title="https://||||||" rel="nofollow"&gt;https://&lt;/th&gt;</nowiki>'' - because the ''&lt;a href="xxx'' part has been cut off. Probably not exploitable - but certainly a worse category of bug than just getting tags in the wrong order.<br />
So to sum up: if tags are just in the wrong order, but are otherwise complete and well-formed, then it is not a security issue; otherwise it is considered to potentially be, and is listed as "Yes" in the above table.</div>125.46.23.82