Wikimedia

MediaWiki's comment based strip markers (e.g. <!--LINK 0:0-->) should include quotes to avoid being included in attributes (advanced task)

Note: This is harder than most GCI tasks! We recommend doing some of the easier tasks before attempting this one!

The MediaWiki parser puts markers like <!--LINK 0:0--> as a placeholder for links which gets replaced with real links later on. (see includes/parser/Parser.php, especially Parser::replaceInternalLinks() and includes/parser/LinkHolderArray.php)

However, <span title="<!--LINK 0:0-->"> is perfectly valid html which would be broken by the replacement.

As a hardening measure, we should change the marker to be <!--LINK '" 0:0--> so that it would never be in an attribute of valid html.

See the phabricator ticket for more details.

You are expected to provide a patch in Wikimedia Gerrit. See https://www.mediawiki.org/wiki/Gerrit/Tutorial for how to set up Git and Gerrit.

Task tags

  • security
  • php
  • parser

Students who completed this task

Phantom42

Task type

  • code Code
close

2017