From 68d12db61f4545fab4abe07e56506efb9b067b9f Mon Sep 17 00:00:00 2001
From: SomeRandomDeveloper <thisisnotmyname275@gmail.com>
Date: Thu, 22 May 2025 20:58:44 +0200
Subject: [PATCH] SECURITY: Escape unicode icons

This addresses an XSS vulnerability that allowed injecting any HTML
into the DOM by using the 'titleicon_unicode' parser function.

Bug: T394721
---
 src/IconManager.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/IconManager.php b/src/IconManager.php
index 7cb177f..74b3c86 100644
--- a/src/IconManager.php
+++ b/src/IconManager.php
@@ -37,6 +37,7 @@ use Message;
 use PageProps;
 use Parser;
 use RepoGroup;
+use Sanitizer;
 use Title;
 use TitleParser;
 
@@ -404,7 +405,7 @@ class IconManager {
 		}
 		return $this->linkRenderer->makeLink(
 			$linkTitle,
-			new HtmlArmor( $icon->getIcon() )
+			Sanitizer::decodeCharReferences( $icon->getIcon() )
 		) . "\u{00A0}";
 	}
 
-- 
2.49.0