SECURITY: Escape > in Html::expandAttributes

Escape > characters in attributes, so we don't confuse post-processing,
like LanguageConverter.

Bug: T73394
Change-Id: I768e2a12c7b6ba635e6c8571676b8c776b16bf72

diff --git a/includes/Html.php b/includes/Html.php
index 4b69885..effc488 100644 (file)
--- a/includes/Html.php
+++ b/includes/Html.php
@@ -600,17 +600,20 @@ class Html {
                        } else {
                                // Apparently we need to entity-encode \n, \r, \t, although the
                                // spec doesn't mention that.  Since we're doing strtr() anyway,
-                               // and we don't need <> escaped here, we may as well not call
-                               // htmlspecialchars().
+                               // we may as well not call htmlspecialchars().
                                // @todo FIXME: Verify that we actually need to
                                // escape \n\r\t here, and explain why, exactly.
                                #
                                // We could call Sanitizer::encodeAttribute() for this, but we
                                // don't because we're stubborn and like our marginal savings on
                                // byte size from not having to encode unnecessary quotes.
+                               // The only difference between this transform and the one by
+                               // Sanitizer::encodeAttribute() is '<' is only encoded here if
+                               // $wgWellFormedXml is set, and ' is not encoded.
                                $map = array(
                                        '&' => '&amp;',
                                        '"' => '&quot;',
+                                       '>' => '&gt;',
                                        "\n" => '&#10;',
                                        "\r" => '&#13;',
                                        "\t" => '&#9;'

diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index 2b7f4cd..f660678 100644 (file)
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -13901,7 +13901,7 @@ section 5
 </ul>
 </div>
 
-<h2><span class="mw-headline" id="text_.3E_text">text &gt; text</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=1" title="Edit section: text > text">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
+<h2><span class="mw-headline" id="text_.3E_text">text &gt; text</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=1" title="Edit section: text &gt; text">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
 <p>section 1
 </p>
 <h2><span class="mw-headline" id="text_.3C_text">text &lt; text</span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=2" title="Edit section: text &lt; text">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
@@ -19608,7 +19608,7 @@ __TOC__
 </div>
 
 <h2><span class="mw-headline" id="Hello"><sup class="in-h2">Hello</sup></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=1" title="Edit section: Hello">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
-<h2><span class="mw-headline" id="b.22.3EEvilbye"><sup> b"&gt;Evilbye</sup></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=2" title="Edit section: b&quot;>Evilbye">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
+<h2><span class="mw-headline" id="b.22.3EEvilbye"><sup> b"&gt;Evilbye</sup></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=2" title="Edit section: b&quot;&gt;Evilbye">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
 
 !! end