Description

pppery

opened on Oct 5, 2023

Issue body actions

Per https://www.mediawiki.org/w/index.php?title=Extension:SaferHTMLTag&diff=prev&oldid=5789945

Activity

1. pppery

   changed the title [-]"The html tag check can be bypassed by obfuscating the html tag, leading to a false sense of security [/-] [+]"The html tag check can be bypassed by obfuscating the html tag, leading to a false sense of security"[/+] on Oct 5, 2023
2. bitsofmymind

   closed this as completedin 211620bon Feb 19, 2024
3. bitsofmymind commented on Feb 19, 2024

   

   bitsofmymind

   on Feb 19, 2024

   Member

   More actions

   I think I've fixed the issue. The page is parsed again before getting saved and if an HTML tag is detected by the Parser an error is triggered.
4. bawolff commented on Feb 20, 2024

   

   bawolff

   on Feb 20, 2024

   More actions

   There are still ways to bypass it. For example: {{#{{#ifexpr:{{#time:U}}+10>1708471495|tag:html|if:}}|<script>alert(1)</script>}}

   I don't think its possible in principle to detect all possibilities in this manner. I think it is equivalent to the halting problem.

   ---

   If you really want to do something like this, maybe the way to do it is during PST (i.e. ParserPreSaveTransformComplete hook), look for tags with a regex, capture the text inside the tag, calculate base64_encode(hash_hmac( 'sha256', $insideOfHtmlTag, $wgSecretKey ) ), and add that as an attribute to the tag only if the user is an authorized user. Then also override the html tag hook to calculate the same value, and only execute the html if the values match.

   Still a bit sketchy. I'd worry about cases where PST is not stable (probably fixable by running PST twice and making sure the result is the same). But i think its more likely to be able to be made secure if running during PST instead of main parsing.
5. bitsofmymind commented on Feb 21, 2024

   

   bitsofmymind

   on Feb 21, 2024

   Member

   More actions

   Seems to me like the hash technique this could easily be bypassed. Unless I'm not understanding it correctly.

   Right now, the code works to prevent pages containing the html tag from being saved. If indeed it is a halting type of problem then maybe we should figure a different solution entirely.

   How about preventing a page from being parsed at display time if:

   1. an html tag is detected (easily done with a Parser hook)
   2. the last user to save the page does not have the rights to work with pages containing the html tag ?

   Preventing such a page from even getting displayed could act as a last resort mesure to ensure the safety of the code (when all else has failed).

Issue actions