From 6ce0c0d1453a6d2526c5ed6efb952ca6f67850eb Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Mon, 2 Nov 2015 14:28:24 -0700 Subject: [PATCH] Escape 0x7F, so that MW parser won't think its a strip marker MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If you could get an OOUI widget output into an area controlled by the parser (e.g. Transcludable special page), and then get a strip marker into an attribute, you might be able to bypass the attribute's escaping. I escaped 0x7F -> '␡' instead of , as control characters aren't really supposed to be in HTML5 documents anyways. Bug: T110143 --- php/Tag.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/php/Tag.php b/php/Tag.php index e5fa9df..6e15fe9 100644 --- a/php/Tag.php +++ b/php/Tag.php @@ -328,7 +328,9 @@ class Tag { $value = htmlspecialchars( $value, ENT_QUOTES ); // 2. Decode double quotes, for readability. $value = str_replace( '"', '"', $value ); - // 3. Wrap attribute value in single quotes in the HTML. + // 3. Encode 0x7F for benefit of MediaWiki parser + $value = str_replace( "\x7F", "␡", $value ); + // 4. Wrap attribute value in single quotes in the HTML. $attributes .= ' ' . $key . "='" . $value . "'"; } -- 2.0.1