MediaWiki

From Nick Jenkins
Revision as of 15:08, 1 October 2008 by 125.46.23.82 (Talk)

Jump to: navigation, search

Hello visitor! If you found this page, then you probably wanted something else. Here are links to what you're probably looking for:

Now back to your regularly scheduled programming....


Various MediaWiki 1.7.1 and extension parser tests, that fail HTML validation and/or have potential security issues. There is a MediaWiki bug report covering this. Some were found by hand, but most of these were found by fuzz testing of MediaWiki, using a modified PHP port of the Python port of mangleme. The original source code is available, although the version now in the MediaWiki trunk is much more current. Lastly, all the MediaWiki tests listed below are released into the public domain, and as such you're welcome to incorporate them into any software you like, under any license you like.

Very interesting tale <a href=" Pthc ">Loli Hc Bbs</a> 705847

Hello good day <a href=" indonesian lolitas ">little

</a> 512

Completely fixed

Things belong here if they now give valid HTML, don't cause PHP errors/warnings or SQL errors/warnings, and don't cause Tidy warnings.

Test Wiki Source Validate HTML Tidy HTML Security
aspects?
Fixed in Visible
Artefacts?
Notes and any extra info.
MediaWiki/Parser7 Export Wiki Source W3C Validator Tidy HTML No 1.6.1 No. Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.
MediaWiki/Parser13 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.6 No. sDrops the '<a href="xxx' string. Explanation for this + Parser14 + Parser14-table. Completely fixed in 1.6.6.
MediaWiki/Parser14 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.6 Yes No. TOC insertion Completely fixed in 1.6.6.
MediaWiki/Parser14-table Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.6 Yes No. TOC insertion Completely fixed in 1.6.6.
MediaWiki/Parser17 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.1 No. Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.
MediaWiki/Parser18 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.1 No. Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.
MediaWiki/Parser19 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.1 No. Completely fixed in 1.6.1 - valid HTML, no artefacts, no tidy errors.
MediaWiki/Parser21 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.6 No. Completely fixed in 1.6.6 - valid HTML, no artefacts, no tidy errors.
MediaWiki/Parser22 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.6 No. Double links injection. Completely fixed in 1.6.6 - valid HTML, no artefacts, no tidy errors.
MediaWiki/Parser27 Export Wiki Source W3C Validator Tidy HTML No. r14480 No. PHP warning in Sort extension, fixed in r14480.
MediaWiki/Parser32 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.7 No. User-specified JavaScript execution. Must be running an experimental extension, so most installations are
NOT affected. Wiki text not released yet. Fixed in trunk by r14511, and fixed in 1.6.7.
MediaWiki/Parser35 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.7 No. Limited attribute injection using CharInsert extension + Math extension.
MediaWiki/Parser38 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.7 No. Limited attribute injection using CharInsert extension + Cite extension.
MediaWiki/Parser42 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.7 No. Section heading abuse for gave Tidy error, strange page rendering, and a limited attribute injection.
MediaWiki/Parser43 Export Wiki Source W3C Validator Tidy HTML Yes No. 1.6.7 No. XSS Arbitrary JavaScript execution and HTML insertion. Fixed in 1.6.7 and fixed in r14585 for trunk.
MediaWiki/Parser44 Export Wiki Source W3C Validator Tidy HTML No. r14733 No. PHP warning in InputBox extension in E_ALL with bad input. Fixed in r14733.
MediaWiki/Parser41 Export Wiki Source W3C Validator Tidy HTML Yes No. r14544 No. Wikitext of death (causes internal Parser error). Fixed in 1.7, but not in 1.6.
MediaWiki/Parser48 Export Wiki Source W3C Validator Tidy HTML Yes No. No. $wgAllowExternalImages is enabled by default in 1.6 stable, but it is turned off in 1.7 and Trunk by default.
This can be abused on a 1.6 wiki to create a page which when viewed will log the user off.
MediaWiki/Parser2 Export Wiki Source W3C Validator Tidy HTML No No
MediaWiki/Parser20 Export Wiki Source W3C Validator Tidy HTML No No. Nowiki allows malformed URI (e.g. generates multi-line hrefs). Passes W3C validation, but tidy gives warnings, and the
links don't act like normal links (in Firefox, at least) - clicking on them does nothing.
MediaWiki/Parser23 Export Wiki Source W3C Validator Tidy HTML No. No. Pre allows malformed URI. Fails validation (unlike nowiki).
MediaWiki/Parser45 Export Wiki Source W3C Validator Tidy HTML No. r14730 Yes No. PHP notices on the page history with bad input + E_ALL.
MediaWiki/Parser46 Export Wiki Source W3C Validator Tidy HTML No. Yes No. Bad input on Page History that causes SQL error.
MediaWiki/Parser50 Export Wiki Source W3C Validator Tidy HTML No Yes No. Gives PHP fatal error on bad input on Special:Userlogin
MediaWiki/Parser47 Export Wiki Source W3C Validator Tidy HTML No. Yes No. Two PHP notices on Special:Contributions with bad input + E_ALL.

Logged in bugzilla

Lately most new things have been logged in bugzilla, which makes them easier to track.

There is a small amount of overlap between this page and bugzilla, namely for the following bugs:

Test Wiki Source Validate HTML Tidy HTML Security
aspects?
Fixed in Visible
Artefacts?
Notes and any extra info.
MediaWiki/Parser51 Export Wiki Source W3C Validator Tidy HTML No Yes PHP warnings on malformed cookie session_id on Special:Userlogin. Also logged as MediaZilla:6538

Definition of Security Aspects

For the above table, "security aspect" is defined as anything that causes the start of a tag to be missing, or the end to be missing, or attributes of any type that should not be there to be injected. For example:

  • <p><td><s></p> would not be considered to have a security aspect because all the tags are appearing ok (are not malformed), although it is invalid HTML.
  • <a href="http://as<td></td><td class="external free"><p>user text here would be considered to have a security aspect because the "href" string is not properly terminated, and so the "external free" part is injected as attributes.
  • A string missing the start of a tag would also be considered to have a security aspect - e.g. <th>|||||" class="external free" title="https://||||||" rel="nofollow">https://</th> - because the <a href="xxx part has been cut off. Probably not exploitable - but certainly a worse category of bug than just getting tags in the wrong order.

So to sum up: if tags are just in the wrong order, but are otherwise complete and well-formed, then it is not a security issue; otherwise it is considered to potentially be, and is listed as "Yes" in the above table.