From e8640ea8bff0c485bb2a652d59a09890371ee52c Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Mon, 14 Mar 2016 01:09:58 -0400 Subject: [PATCH] Don't destroy strip markers when escaping html in mw.html lua. Note: The results of this are still processed as wikitext - the escaping is to ensure that arguments to lua modules don't "overflow". This should not affect escaping done for XSS reasons. This is a follow-up to the changes in strip marker behaviour in T110143. Previously strip markers did not contain escaped characters, so this restores previous behaviour. See also T70011. This fix makes "Strip markers in CSS" parser test pass again. Change-Id: I1353931a53c668d8a453dfa2300a99f59fdb01c5 --- engines/LuaCommon/lualib/mw.html.lua | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/engines/LuaCommon/lualib/mw.html.lua b/engines/LuaCommon/lualib/mw.html.lua index 7411de5..e7c0c24 100644 --- a/engines/LuaCommon/lualib/mw.html.lua +++ b/engines/LuaCommon/lualib/mw.html.lua @@ -87,7 +87,11 @@ end -- @param s local function htmlEncode( s ) -- The parentheses ensure that there is only one return value - return ( string.gsub( s, '[<>&"]', htmlencodeMap ) ) + local tmp = ( string.gsub( s, '[<>&"]', htmlencodeMap ) ); + -- Don't destroy strip markers here. (T110143) + tmp = ( string.gsub( tmp, "\127'"`UNIQ", "\127'\"`UNIQ" ) ) + tmp = ( string.gsub( tmp, "QINU`"'\127", "QINU`\"'\127" ) ) + return tmp end local function cssEncode( s ) -- 2.0.1