Difference between revisions of "MediaWiki"
From Nick Jenkins
m (Update for 1.6.1) |
(+3 more I was sitting on, which have since been fixed.) |
||
| Line 149: | Line 149: | ||
| No. | | No. | ||
| <s>Generates Tidy error due to <th> tags out of order.</s> As of 1.6, now drops the '<a href="xxx' string. | | <s>Generates Tidy error due to <th> tags out of order.</s> As of 1.6, now drops the '<a href="xxx' string. | ||
| + | |- | ||
| + | | <s>[[MediaWiki/Parser17]]</s> | ||
| + | | <s>[[Special:Export/MediaWiki/Parser17|Export Wiki Source]]</s> | ||
| + | | <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser17 W3C Validator]</s> | ||
| + | | <s>{{tidy-html|page=MediaWiki/Parser17}}</s> | ||
| + | | <s>Yes.</s> No. | ||
| + | | No. | ||
| + | | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. | ||
| + | |- | ||
| + | | <s>[[MediaWiki/Parser18]]</s> | ||
| + | | <s>[[Special:Export/MediaWiki/Parser18|Export Wiki Source]]</s> | ||
| + | | <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser18 W3C Validator]</s> | ||
| + | | <s>{{tidy-html|page=MediaWiki/Parser18}}</s> | ||
| + | | <s>Yes.</s> No. | ||
| + | | No. | ||
| + | | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. | ||
| + | |- | ||
| + | | <s>[[MediaWiki/Parser19]]</s> | ||
| + | | <s>[[Special:Export/MediaWiki/Parser19|Export Wiki Source]]</s> | ||
| + | | <s>[http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser19 W3C Validator]</s> | ||
| + | | <s>{{tidy-html|page=MediaWiki/Parser19}}</s> | ||
| + | | <s>Yes.</s> No. | ||
| + | | No. | ||
| + | | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. | ||
|} | |} | ||
Revision as of 05:29, 7 April 2006
Various MediaWiki 1.6.1 parser tests, that fail HTML validation:
1: For the above table, "security aspect" is defined as anything that causes the start of a tag to be missing, or the end to be missing, or attributes of any type that should not be there to be injected. For example:
- <p><td><s></p> would not be considered to have a security aspect because all the tags are appearing ok (are not malformed), although it is invalid HTML.
- <a href="http://as<td></td><td class="external free"><p>user text here would be considered to have a security aspect because the "href" string is not properly terminated, and so the "external free" part is injected as attributes.
- A string missing the start of a tag would also be considered to have a security aspect - e.g. <th>|||||" class="external free" title="https://%7C%7C%7C%7C%7C%7C" rel="nofollow">https://</th> - because the <a href="xxx part has been cut off.
So to sum up: if tags are just in the wrong order, but are otherwise complete and well-formed, then it is not a security issue; otherwise it is considered to potentially be, and is listed as "Yes" in the above table.
