Using language conversion syntax in external links bypasses proper external link registration
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	liangent
	Jan 21 2015, 3:03 PM

Description

I just realized that -{}- works in external links, such as [http://www.-{zh-cn:weibo;zh-tw:twitter}-.com Microblogging] and is not a side effect: it has been deliberately used by a converter developer: https://zh.wikipedia.org/w/index.php?title=2008年西藏骚乱&diff=6478425&oldid=6478406 .

However this causes http://www.-{zh-cn:weibo;zh-tw:twitter}-.com to be registered as an external link in parser output, instead of either http://www.weibo.com or http://www.twitter.com , thus the links http://www.weibo.com and http://www.twitter.com seen by final users cannot be detected in code, which can be abused, for example, to bypass the spam blacklist ([http://-{tinyurl}-.com/foobar Foobar] just works: https://zh.wikipedia.org/w/index.php?title=Wikipedia:%E6%B2%99%E7%9B%92&diff=34043017&oldid=34042783&unhide=1 ), and pollutes externallinks table.

I believe such usage will also cause problems in Parsoid; cc'ing cscott. Not sure if this leads to any security issues but it seems unlikely.

Related Objects

Mentioned In: T119158: Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815)
Mentioned Here: T119158: Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815)

Event Timeline

Maniphest changed the visibility from "Public (No Login Required)" to "Custom Policy".Jan 21 2015, 3:03 PM

Maniphest changed the edit policy from "All Users" to "Custom Policy".

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 21 2015, 3:03 PM

liangent created this task.Jan 21 2015, 3:03 PM

liangent updated the task description. (Show Details)

liangent added projects: MediaWiki-Language-converter, acl*security.

liangent changed Security from None to Software security bug.

liangent updated the task description. (Show Details)

liangent edited subscribers, added: liangent, cscott; removed: Aklapper.

• dpatrick claimed this task.Aug 11 2015, 9:37 PM

• dpatrick triaged this task as Low priority.

• dpatrick raised the priority of this task from Low to Medium.

• dpatrick added a project: Security-Team.

Krenair added a project: Parsoid.Aug 11 2015, 9:40 PM

Krenair subscribed.

• dpatrick moved this task from Incoming to Ready on the Security-Team board.Nov 18 2015, 9:45 PM

Bawolff mentioned this in T119158: Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815).Dec 14 2015, 8:10 AM

Note: i expect the patch on T119158 will break this behaviour

In T87332#1999997, @Bawolff wrote:

Note: i expect the patch on T119158 will break this behaviour

I don't have access to that ticket. Can you add me there?

• dpatrick removed • dpatrick as the assignee of this task.May 9 2016, 6:26 PM

• dpatrick subscribed.

For reference there are ~ 1600 such links (approx)

MariaDB [zhwiki_p]> select count(*) from externallinks where  el_to like '%-\%7B%\%7D-%' limit 4;
+----------+
| count(*) |
+----------+
|     1674 |
+----------+
1 row in set (3.67 sec)

MariaDB [zhwiki_p]> select count(*) from externallinks where el_to like '%-\%7B%\%7D-' limit 3\G
*************************** 1. row ***************************
count(*): 39

Looks like less of a concern now.

Fixed as part of T119158

Bawolff closed this task as Resolved.Dec 10 2017, 4:07 PM

Bawolff claimed this task.

Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".

Bawolff changed the edit policy from "Custom Policy" to "All Users".

Restricted Application added a subscriber: Stang. · View Herald TranscriptDec 10 2017, 4:07 PM

• chasemp added a project: Security.Feb 10 2020, 10:59 PM

• chasemp removed a project: acl*security.Feb 20 2020, 8:18 PM

Stang unsubscribed.Nov 13 2021, 11:44 PM

Winston_Sung moved this task from Backlog to Security on the MediaWiki-Language-converter board.Dec 27 2023, 6:18 PM

Using language conversion syntax in external links bypasses proper external link registrationClosed, ResolvedPublicActions

Description

Related Objects

Event Timeline

Using language conversion syntax in external links bypasses proper external link registration
Closed, ResolvedPublic
Actions