Difference between revisions of "MediaWiki"
From Nick Jenkins
(→HTML Validation or PHP errors or SQL errors) |
(→HTML Validation or PHP errors or SQL errors) |
||
| Line 377: | Line 377: | ||
| bgcolor=grey | Yes | | bgcolor=grey | Yes | ||
| Shifts content off of the left margin.<br />Causes Tidy errors (in command-line Tidy + the firefox plugin, but not in web version). | | Shifts content off of the left margin.<br />Causes Tidy errors (in command-line Tidy + the firefox plugin, but not in web version). | ||
| + | |- | ||
| + | | [[MediaWiki/Parser50]] | ||
| + | | [[Special:Export/MediaWiki/Parser50|Export Wiki Source]] | ||
| + | | [http://validator.w3.org/check?uri=http://nickj.org/MediaWiki/Parser50 W3C Validator] | ||
| + | | {{tidy-html|page=MediaWiki/Parser50}} | ||
| + | | No | ||
| + | | | ||
| + | | bgcolor=grey | Yes | ||
| + | | Gives PHP fatal error on bad input when logging in. | ||
|} | |} | ||
Revision as of 02:56, 20 June 2006
Various MediaWiki 1.6.7 and extension parser tests, that fail HTML validation and/or have potential security issues. There is a MediaWiki bug report covering this. Some were found by hand, but most of these were found by fuzz testing of MediaWiki, using a modified PHP port of the Python port of mangleme. The source code is available, although the version now in the MediaWiki trunk is probably more current (changelog). Lastly, all the MediaWiki tests listed below are released into the public domain, and as such you're welcome to incorporate them into any software you like, under any license you like.
Contents
Security items
| Test | Wiki Source | Validate HTML | Tidy HTML | Security aspects? |
Fixed in | Visible Artefacts? |
Notes and any extra info. |
|---|---|---|---|---|---|---|---|
| MediaWiki/Parser40 | Export Wiki Source | W3C Validator | Tidy HTML | Yes | No. | Limited dl/dd/dt attribute injection. Fixed in trunk in r14541 + a later speed-up patch, but not currently fixed in 1.6 stable release. | |
| MediaWiki/Parser41 | Export Wiki Source | W3C Validator | Tidy HTML | Yes | No. | Wikitext of death (causes internal Parser error). Fixed in trunk in r14544, but not currently fixed in 1.6 stable release. If a way is found to save into a common template could potentially act as a DoS. | |
| MediaWiki/Parser48 | Export Wiki Source | W3C Validator | Tidy HTML | Yes | No. | $wgAllowExternalImages is enabled by default in 1.6 stable, but it is turned off in Trunk by default. This can be abused on a 1.6 wiki to create a page which when viewed will log the user off. |
HTML Validation or PHP errors or SQL errors
Things that cause one or more of the following:
- Visual artefacts
- PHP errors
- SQL errors
- Tidy errors (not just warnings)
... have been marked with grey to indicate that they may be of higher impact than the other items:
| Test | Wiki Source | Validate HTML | Tidy HTML | Security aspects? |
Fixed in | Visible Artefacts? |
Notes and any extra info. |
|---|---|---|---|---|---|---|---|
| MediaWiki/Parser1 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Stikes out almost all text. Explanation for this + Parser1-hidden + Parser2 + Parser3 + Parser4 + Parser5. | |
| MediaWiki/Parser1-hidden | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Hides almost all text, which also makes all page links unavailable. | |
| MediaWiki/Parser2 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser3 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser4 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser5 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Shrinks font, moves the top page action links up about 5 pixels and left about 10 pixels. | |
| MediaWiki/Parser6 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Shrinks font, moves the left navigation bar down about 160 pixels, strikes out almost all text. | |
| MediaWiki/Parser8 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser9 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser10 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser11 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | Explanation. Security aspects fixed in 1.6.1, although still fails W3C Validation. | |
| MediaWiki/Parser12 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | Explanation. Security aspects fixed in 1.6.1, although still fails W3C Validation. | |
| MediaWiki/Parser15 | Export Wiki Source | W3C Validator | Tidy HTML | No | No. | | |
| MediaWiki/Parser16 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | Security aspects fixed in 1.6.6, although still fails W3C Validation. | |
| MediaWiki/Parser20 | Export Wiki Source | W3C Validator | Tidy HTML | No | No. | Nowiki allows malformed URI (e.g. generates multi-line hrefs). Passes W3C validation, but tidy gives warnings, and the links don't act like normal links (in Firefox, at least) - clicking on them does nothing. | |
| MediaWiki/Parser23 | Export Wiki Source | W3C Validator | Tidy HTML | No. | No. | Pre allows malformed URI. Fails validation (unlike nowiki). | |
| MediaWiki/Parser24 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser25 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser25-variant1 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser25-variant2 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser26 | Export Wiki Source | W3C Validator | Tidy HTML | |
|
Attribute injection in Cite extension fixed in r14400, and visual aspects fixed in r14399, although still fails W3C Validation. | |
| MediaWiki/Parser33 | Export Wiki Source | W3C Validator | Tidy HTML | No. | Yes. | Numerous Tidy errors (using both the command-line version, and the Firefox plugin, but not with the web version) | |
| MediaWiki/Parser34 | Export Wiki Source | W3C Validator | Tidy HTML | No. | Yes. | Whacky page rendering, indents the nav bar from the left margin and into body text. | |
| MediaWiki/Parser45 | Export Wiki Source | W3C Validator | Tidy HTML | No. | Yes. | PHP notices on the page history with bad input + E_ALL. Fixed in trunk in r14730, but not currently fixed in 1.6 stable release. | |
| MediaWiki/Parser46 | Export Wiki Source | W3C Validator | Tidy HTML | No. | Yes. | Bad input on Page History that causes SQL error. | |
| MediaWiki/Parser47 | Export Wiki Source | W3C Validator | Tidy HTML | No. | Yes. | Two PHP notices on Special:Contributions with bad input + E_ALL. | |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using Sort extension + another extension (References in this example). Can no longer reproduce, is certainly fixed in 1.6.7. Still fails W3C validation. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using Sort extension + another extension (Math in this example). Still fails W3C validation. |
| |
|
|
|
No. | r14475 | No. | Invalid <left> tag on bad timeline extension input. Fixed in r14475. Still fails W3C validation. |
| |
|
|
|
No. | N/A. | No. | Bogus - unable to reproduce problem. Still fails W3C validation. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using inputbox extension + another extension. Still fails W3C validation. |
| |
|
|
|
|
1.6.7 | No. | JavaScript execution using CharInsert + Sort extension. Still fails W3C validation. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using CharInsert extension + InputBox extension. Still fails W3C validation. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using CharInsert extension + InputBox extension + Math extension. Still fails W3C validation. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using CharInsert extension + Cite extension. Still fails validation. |
| MediaWiki/Parser49 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Shifts content off of the left margin. Causes Tidy errors (in command-line Tidy + the firefox plugin, but not in web version). | |
| MediaWiki/Parser50 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Gives PHP fatal error on bad input when logging in. |
Completely fixed
| Test | Wiki Source | Validate HTML | Tidy HTML | Security aspects? |
Fixed in | Visible Artefacts? |
Notes and any extra info. |
|---|---|---|---|---|---|---|---|
| |
|
|
|
No | 1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.6 | No. | |
| |
|
|
|
|
1.6.6 | |
|
| |
|
|
|
|
1.6.6 | |
|
| |
|
|
|
|
1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.6 | No. | Completely fixed in 1.6.6 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.6 | No. | |
| |
|
|
|
No. | r14480 | No. | PHP warning in Sort extension, fixed in r14480. |
| |
|
|
|
|
1.6.7 | No. | User-specified JavaScript execution. Must be running an experimental extension, so most installations are NOT affected. Wiki text not released yet. Fixed in trunk by r14511, and fixed in 1.6.7. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using CharInsert extension + Math extension. |
| |
|
|
|
|
1.6.7 | No. | Limited attribute injection using CharInsert extension + Cite extension. |
| |
|
|
|
|
1.6.7 | No. | Section heading abuse for gave Tidy error, strange page rendering, and a limited attribute injection. |
| |
|
|
|
|
1.6.7 | No. | XSS Arbitrary JavaScript execution and HTML insertion. Fixed in 1.6.7 and fixed in r14585 for trunk. |
| |
|
|
|
No. | r14733 | No. | PHP warning in InputBox extension in E_ALL with bad input. Fixed in r14733. |
Definition of Security Aspects
For the above table, "security aspect" is defined as anything that causes the start of a tag to be missing, or the end to be missing, or attributes of any type that should not be there to be injected. For example:
- <p><td><s></p> would not be considered to have a security aspect because all the tags are appearing ok (are not malformed), although it is invalid HTML.
- <a href="http://as<td></td><td class="external free"><p>user text here would be considered to have a security aspect because the "href" string is not properly terminated, and so the "external free" part is injected as attributes.
- A string missing the start of a tag would also be considered to have a security aspect - e.g. <th>|||||" class="external free" title="https://||||||" rel="nofollow">https://</th> - because the <a href="xxx part has been cut off. Probably not exploitable - but certainly a worse category of bug than just getting tags in the wrong order.
So to sum up: if tags are just in the wrong order, but are otherwise complete and well-formed, then it is not a security issue; otherwise it is considered to potentially be, and is listed as "Yes" in the above table.
