MediaWiki
From Nick Jenkins
Various MediaWiki 1.6.6 parser tests, that fail HTML validation. There is a MediaWiki bug report covering this. These were all found by fuzz testing of MediaWiki, using a modified PHP port of the Python port of mangleme. The source code is available, although the version now in the MediaWiki trunk is probably more current (changelog). Lastly, all the MediaWiki tests listed below are released into the public domain, and as such you're welcome to incorporate them into any software you like, under any license you like.
| Test | Wiki Source | Validate HTML | Tidy HTML | Security aspects? |
Fixed in | Visible Artefacts? |
Notes and any extra info. |
|---|---|---|---|---|---|---|---|
| MediaWiki/Parser1 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Stikes out almost all text. Explanation for this + Parser1-hidden + Parser2 + Parser3 + Parser4 + Parser5. | |
| MediaWiki/Parser1-hidden | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Hides almost all text, which also makes all page links unavailable. | |
| MediaWiki/Parser2 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser3 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser4 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser5 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Shrinks font, moves the top page action links up about 5 pixels and left about 10 pixels. | |
| MediaWiki/Parser6 | Export Wiki Source | W3C Validator | Tidy HTML | No | Yes | Shrinks font, moves the left navigation bar down about 160 pixels, strikes out almost all text. | |
| |
|
|
|
No | 1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| MediaWiki/Parser8 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser9 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser10 | Export Wiki Source | W3C Validator | Tidy HTML | No | No | ||
| MediaWiki/Parser11 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | Explanation. Security aspects fixed in 1.6.1, although still fails W3C Validation. | |
| MediaWiki/Parser12 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | Explanation. Security aspects fixed in 1.6.1, although still fails W3C Validation. | |
| |
|
|
|
|
1.6.6 | No. | |
| |
|
|
|
|
1.6.6 | |
|
| |
|
|
|
|
1.6.6 | |
|
| MediaWiki/Parser15 | Export Wiki Source | W3C Validator | Tidy HTML | No | No. | | |
| MediaWiki/Parser16 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | Security aspects fixed in 1.6.6, although still fails W3C Validation. | |
| |
|
|
|
|
1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.1 | No. | Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors. |
| MediaWiki/Parser20 | Export Wiki Source | W3C Validator | Tidy HTML | No | No. | Nowiki allows malformed URI (e.g. generates multi-line hrefs). Passes W3C validation, but tidy gives warnings, and the links don't act like normal links (in Firefox, at least) - clicking on them does nothing. | |
| |
|
|
|
|
1.6.6 | No. | Completely fixed in 1.6.6 - valid HTML, no artefacts, no tidy errors. |
| |
|
|
|
|
1.6.6 | No. | |
| MediaWiki/Parser23 | Export Wiki Source | W3C Validator | Tidy HTML | No. | No. | Pre allows malformed URI. Fails validation (unlike nowiki). | |
| MediaWiki/Parser24 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser25 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser25-variant1 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser25-variant2 | Export Wiki Source | W3C Validator | Tidy HTML | |
No. | | |
| MediaWiki/Parser26 | Export Wiki Source | W3C Validator | Tidy HTML | |
|
Attribute injection in Cite extension fixed in r14400, and visual aspects fixed in r14399 | |
| |
|
|
|
No. | No. | PHP warning, fixed in r14480. | |
| MediaWiki/Parser28 | Export Wiki Source | W3C Validator | Tidy HTML | Yes. | No. | Limited attribute injection using Sort extension + another extension (References in this example). (Note: References extension not installed on this wiki). | |
| MediaWiki/Parser28-variant1 | Export Wiki Source | W3C Validator | Tidy HTML | Yes. | No. | Limited attribute injection using Sort extension + another extension (Math in this example). (Note: Math extension not installed on this wiki). | |
| |
|
|
|
No. | No. | Invalid <left> tag on bad timeline extension input. Fixed in r14475. (Note: Timeline extension not installed on this wiki). | |
| MediaWiki/Parser30 | Export Wiki Source | W3C Validator | Tidy HTML | No. | No. | Invalid <left> tag on bad timeline extension input. (Note: Timeline extension not installed on this wiki). | |
| Yes. | No. | Limited attribute injection using one extension + another extension. Wiki text not released yet. |
Definition of Security Aspects
For the above table, "security aspect" is defined as anything that causes the start of a tag to be missing, or the end to be missing, or attributes of any type that should not be there to be injected. For example:
- <p><td><s></p> would not be considered to have a security aspect because all the tags are appearing ok (are not malformed), although it is invalid HTML.
- <a href="http://as<td></td><td class="external free"><p>user text here would be considered to have a security aspect because the "href" string is not properly terminated, and so the "external free" part is injected as attributes.
- A string missing the start of a tag would also be considered to have a security aspect - e.g. <th>|||||" class="external free" title="https://||||||" rel="nofollow">https://</th> - because the <a href="xxx part has been cut off. Probably not exploitable - but certainly a worse category of bug than just getting tags in the wrong order.
So to sum up: if tags are just in the wrong order, but are otherwise complete and well-formed, then it is not a security issue; otherwise it is considered to potentially be, and is listed as "Yes" in the above table.
