From 0496839c8875da1980180f66f2dc8ed2729a93ad Mon Sep 17 00:00:00 2001
From: sbassett <sbassett@wikimedia.org>
Date: Wed, 5 Jan 2022 16:48:45 -0600
Subject: [PATCH] SECURITY: properly escape output used within galleries and
 Special:RevisionDelete

* Sanitize $img->getDimensionsString() within TraditionalImageGallery.php

* Sanitize width, height, nbytes messages within RevDelFileItem.php

Bug: T297543
---
 includes/gallery/TraditionalImageGallery.php | 2 +-
 includes/revisiondelete/RevDelFileItem.php   | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/includes/gallery/TraditionalImageGallery.php b/includes/gallery/TraditionalImageGallery.php
index b5e155a1ef..9dc4579aa5 100644
--- a/includes/gallery/TraditionalImageGallery.php
+++ b/includes/gallery/TraditionalImageGallery.php
@@ -214,7 +214,7 @@ class TraditionalImageGallery extends ImageGalleryBase {
 			$meta = [];
 			if ( $img ) {
 				if ( $this->mShowDimensions ) {
-					$meta[] = $img->getDimensionsString();
+					$meta[] = htmlspecialchars( $img->getDimensionsString() );
 				}
 				if ( $this->mShowBytes ) {
 					$meta[] = htmlspecialchars( $lang->formatSize( $img->getSize() ) );
diff --git a/includes/revisiondelete/RevDelFileItem.php b/includes/revisiondelete/RevDelFileItem.php
index d4c1a013c7..851647a062 100644
--- a/includes/revisiondelete/RevDelFileItem.php
+++ b/includes/revisiondelete/RevDelFileItem.php
@@ -204,8 +204,10 @@ class RevDelFileItem extends RevDelItem {
 	public function getHTML() {
 		$data =
 			$this->list->msg( 'widthheight' )->numParams(
-				$this->file->getWidth(), $this->file->getHeight() )->text() .
-			' (' . $this->list->msg( 'nbytes' )->numParams( $this->file->getSize() )->text() . ')';
+				$this->file->getWidth(),
+				$this->file->getHeight() )->escaped() .
+			' (' . $this->list->msg( 'nbytes' )->numParams(
+				$this->file->getSize() )->escaped() . ')';
 
 		return '<li>' . $this->getLink() . ' ' . $this->getUserTools() . ' ' .
 			$data . ' ' . $this->getComment() . '</li>';
-- 
2.30.2