From e95ca75fa3b04d6e541bc65de954e44c483020cf Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Wed, 18 Oct 2017 05:28:43 +0000 Subject: [PATCH] SECURITY: Escape internal error message This message contains the request url, which is semi-user controlled. Most browsers percent escape < and > so its probably not exploitable (curl is an exception here), but nonetheless its not good. Bug: T178451 Change-Id: I19358471ddf1b28377aad8e0fb54797c817bb6f6 --- RELEASE-NOTES-1.29 | 2 ++ includes/exception/MWException.php | 16 +++++++++------- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29 index ab59109195..59b5d473b8 100644 --- a/RELEASE-NOTES-1.29 +++ b/RELEASE-NOTES-1.29 @@ -12,6 +12,8 @@ This not a release yet! * (T163646) Pass a string not an int to mysql_real_escape_string(). * (T180143) Bump justinrainbow/json-schema development dependency to ~5.2. * Updated dev dependancy phpunit/phpunit from v4.8.35 to v4.8.36. +* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and browser + sends non-standard url escaping. == MediaWiki 1.29.1 == diff --git a/includes/exception/MWException.php b/includes/exception/MWException.php index 4ff8636e2e..ac601bba07 100644 --- a/includes/exception/MWException.php +++ b/includes/exception/MWException.php @@ -114,13 +114,15 @@ class MWException extends Exception { $logId = WebRequest::getRequestId(); $type = static::class; return "
" . - '[' . $logId . '] ' . - gmdate( 'Y-m-d H:i:s' ) . ": " . - $this->msg( "internalerror-fatal-exception", - "Fatal exception of type $1", - $type, - $logId, - MWExceptionHandler::getURL( $this ) + htmlspecialchars( + '[' . $logId . '] ' . + gmdate( 'Y-m-d H:i:s' ) . ": " . + $this->msg( "internalerror-fatal-exception", + "Fatal exception of type $1", + $type, + $logId, + MWExceptionHandler::getURL( $this ) + ) ) . "
\n" . "