From 7e4fe439d0e466e3e1ecaff961eb37aa407836ae Mon Sep 17 00:00:00 2001 From: SomeRandomDeveloper Date: Sat, 16 Aug 2025 11:17:55 +0200 Subject: [PATCH] SECURITY: Parse message instead of inserting it as HTML This fixes a stored i18n XSS vulnerability. Bug: T402076 Change-Id: Iad040d324ca70a187b90f32236a7269e385996b6 --- i18n/en.json | 2 +- .../translation/pages/SelectSourcePage.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/i18n/en.json b/i18n/en.json index abcd8973..28b6a45c 100644 --- a/i18n/en.json +++ b/i18n/en.json @@ -360,7 +360,7 @@ "securepoll-translation-result-description": "Imported translations from", "securepoll-translation-import-start": "Start importing", "securepoll-translation-select-import-source": "Select page from $1", - "securepoll-translation-select-import-source-api": "Provide the MediaWiki Action API source:", + "securepoll-translation-select-import-source-api": "Provide the [https://www.mediawiki.org/wiki/API:Main_page MediaWiki Action API] source:", "securepoll-translation-select-import-source-page": "Provide the page title from the source above:", "securepoll-translation-import-dialog-title": "Import translations", "securepoll-translation-import-action-import": "Import", diff --git a/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js b/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js index 739c7ef8..38f08f3f 100644 --- a/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js +++ b/modules/ext.securepoll.htmlform/translation/pages/SelectSourcePage.js @@ -9,7 +9,7 @@ function SelectSourcePage( name, cfg ) { label: new OO.ui.HtmlSnippet( mw.message( 'securepoll-translation-select-import-source-api' - ).plain() + ).parse() ) } ); this.sourceInput = new OO.ui.TextInputWidget( { -- 2.50.1