From c1eead67f4bd688f89d12b1da4109aa2b5756670 Mon Sep 17 00:00:00 2001
From: SomeRandomDeveloper <thisisnotmyname275@gmail.com>
Date: Sat, 26 Jul 2025 17:54:44 +0200
Subject: [PATCH] SECURITY: Parse system messages before inserting as HTML

This fixes three stored i18n XSS vulnerabilities.

Change-Id: I86c3bb7b7ce2d856cd2a5be787b703c85d7c41fa
---
 resources/ext.wikistories.builder/components/StoryTextbox.vue | 2 +-
 resources/ext.wikistories.builder/store/story.js              | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/resources/ext.wikistories.builder/components/StoryTextbox.vue b/resources/ext.wikistories.builder/components/StoryTextbox.vue
index c8e6523..b3df860 100644
--- a/resources/ext.wikistories.builder/components/StoryTextbox.vue
+++ b/resources/ext.wikistories.builder/components/StoryTextbox.vue
@@ -29,7 +29,7 @@
 		class="ext-wikistories-current-frame-textbox-select-cta"
 		@click="onSelect"
 	>
-		<span v-html="$i18n( 'wikistories-story-selecttext' ).text()"></span>
+		<span v-html="$i18n( 'wikistories-story-selecttext' ).parse()"></span>
 	</div>
 </template>
 
diff --git a/resources/ext.wikistories.builder/store/story.js b/resources/ext.wikistories.builder/store/story.js
index f7bc299..5195fe9 100644
--- a/resources/ext.wikistories.builder/store/story.js
+++ b/resources/ext.wikistories.builder/store/story.js
@@ -183,7 +183,7 @@ module.exports = {
 			const duplicates = {};
 			const warningMessage = {};
 			const duplicate = {
-				message: mw.msg( 'wikistories-story-edittext-duplicate' ),
+				message: mw.message( 'wikistories-story-edittext-duplicate' ).parse(),
 				icon: 'warning',
 				invertIconInDarkMode: true,
 				isAlwaysShown: true,
@@ -201,7 +201,7 @@ module.exports = {
 				// check if frame text is outdated (based on older version of article)
 				if ( frame.outdatedText ) {
 					warningMessage[ i ] = {
-						message: mw.msg( 'wikistories-story-edittext-outdated' ),
+						message: mw.message( 'wikistories-story-edittext-outdated' ).parse(),
 						icon: 'alert',
 						isAlwaysShown: true,
 						replace: true
-- 
2.50.1