Cargo security fixes from upstream

i18n/en.json

@@ -88,7 +88,7 @@
 	"cargo-cargotables-action-delete": "Delete",
 	"cargo-cargotables-action-recreate": "Recreate",
 	"cargo-cargotables-specialtables": "The following special tables exist:",
-	"cargo-cargotables-beingpopulated": "<strong>Note:</strong> One or more of these tables are currently being populated, via the job queue.",
+	"cargo-cargotables-beingpopulated": "'''Note:''' One or more of these tables are currently being populated, via the job queue.",
 	"cargo-cargotables-tablelist": "The following {{PLURAL:$1|table is|tables are}} defined:",
 	"cargo-cargotables-viewtable": "View table: $1",
 	"cargo-cargotables-viewtablelink": "View table",

includes/CargoFieldDescription.php

@@ -363,11 +363,11 @@ public function prepareAndValidateValue( $fieldValue ) {
 	}
 
 	public function prettyPrintType() {
-		$typeDesc = '<tt>' . $this->mType . '</tt>';
+		$typeDesc = Html::element( 'tt', null, $this->mType );
 		if ( $this->mIsList ) {
-			$delimiter = '<tt>' . $this->mDelimiter . '</tt>';
-			$typeDesc = wfMessage( 'cargo-cargotables-listof',
-				$typeDesc, $delimiter )->parse();
+			$delimiter = Html::element( 'tt', null, $this->mDelimiter );
+			$typeDesc = wfMessage( 'cargo-cargotables-listof' )
+				->rawParams( $typeDesc, $delimiter )->escaped();
 		}
 		return $typeDesc;
 	}
@@ -377,14 +377,15 @@ public function prettyPrintTypeAndAttributes() {
 
 		$attributesStrings = [];
 		if ( $this->mIsMandatory ) {
-			$attributesStrings[] = [ wfMessage( 'cargo-cargotables-mandatory' )->text() ];
+			$attributesStrings[] = [ wfMessage( 'cargo-cargotables-mandatory' )->escaped() ];
 		}
 		if ( $this->mIsUnique ) {
-			$attributesStrings[] = [ wfMessage( 'cargo-cargotables-unique' )->text() ];
+			$attributesStrings[] = [ wfMessage( 'cargo-cargotables-unique' )->escaped() ];
 		}
 		if ( $this->mAllowedValues !== null ) {
-			$allowedValuesStr = implode( ' &middot; ', $this->mAllowedValues );
-			$attributesStrings[] = [ wfMessage( 'cargo-cargotables-allowedvalues' )->text(),
+			$escapedAllowedValues = array_map( 'htmlspecialchars', $this->mAllowedValues );
+			$allowedValuesStr = implode( ' &middot; ', $escapedAllowedValues );
+			$attributesStrings[] = [ wfMessage( 'cargo-cargotables-allowedvalues' )->escaped(),
 				$allowedValuesStr ];
 		}
 		if ( count( $attributesStrings ) == 0 ) {

includes/CargoQueryPage.php

@@ -63,7 +63,11 @@ public function __construct( $name = 'CargoQuery' ) {
 			if ( !in_array( $paramName,
 					[ 'title', 'tables', 'fields', 'join on', 'order by', 'group by', 'having', 'format',
 					'offset' ] ) ) {
-				$this->displayParams[$paramName] = $value;
+				if ( is_array( $value ) ) {
+					$this->displayParams[$paramName] = array_map( 'htmlspecialchars', $value );
+				} else {
+					$this->displayParams[$paramName] = htmlspecialchars( $value );
+				}
 			}
 		}
 

includes/CargoUtils.php

@@ -427,6 +427,11 @@ public static function getDateFunctions( $dateDBField ) {
 	public static function smartParse( $value, $parser ) {
 		global $wgRequest;
 
+		// Escape immediately if it's blank or null.
+		if ( $value == '' ) {
+			return '';
+		}
+
 		// This decode() call is here in case the value was
 		// set using {{PAGENAME}}, which for some reason
 		// HTML-encodes some of its characters - see

includes/formats/CargoDynamicTableFormat.php

@@ -159,7 +159,7 @@ public function display( $valuesTable, $formattedValuesTable, $fieldDescriptions
 				continue;
 			}
 			if ( $searchableColumns ) {
-				$placeholder = wfMessage( 'cargo-dynamictables-searchcolumn', $fieldName )->parse();
+				$placeholder = wfMessage( 'cargo-dynamictables-searchcolumn', $fieldName )->escaped();
 				$attribs = [ 'data-placeholder' => $placeholder ];
 			} else {
 				$attribs = null;

includes/formats/CargoGalleryFormat.php

@@ -7,6 +7,8 @@
  * <gallery> tag.
  */
 
+use MediaWiki\MediaWikiServices;
+
 class CargoGalleryFormat extends CargoDisplayFormat {
 
 	public static function allowedParameters() {
@@ -141,6 +143,7 @@ public function display( $valuesTable, $formattedValuesTable, $fieldDescriptions
 			// User specified something invalid, fallback to default.
 			$gallery = ImageGalleryBase::factory( false );
 		}
+		$gallery->setParser( MediaWikiServices::getInstance()->getParser() );
 		if ( array_key_exists( 'show bytes', $displayParams ) ) {
 			$gallery->setShowBytes( $displayParams['show bytes'] );
 		}

includes/parserfunctions/CargoQuery.php

@@ -71,7 +71,7 @@ public static function run( $parser ) {
 				$format = $value;
 			} else {
 				// We'll assume it's going to the formatter.
-				$displayParams[$key] = $value;
+				$displayParams[$key] = htmlspecialchars( $value );
 			}
 		}
 		// Special handling.

includes/specials/CargoPageValues.php

@@ -75,7 +75,7 @@ public function execute( $subpage = null ) {
 
 			$tableLink = $this->getTableLink( $tableName );
 
-			$tableSectionHeader = $this->msg( 'cargo-pagevalues-tablevalues', $tableLink )->text();
+			$tableSectionHeader = $this->msg( 'cargo-pagevalues-tablevalues' )->rawParams( $tableLink )->escaped();
 			$tableSectionTocDisplay = $this->msg( 'cargo-pagevalues-tablevalues', $tableName )->text();
 			$tableSectionAnchor = $this->msg( 'cargo-pagevalues-tablevalues', $tableName )->escaped();
 			$tableSectionAnchor = Sanitizer::escapeIdForAttribute( $tableSectionAnchor );

includes/specials/CargoTables.php

@@ -47,7 +47,7 @@ public function execute( $tableName ) {
 
 		if ( !CargoUtils::tableFullyExists( $tableName ) ) {
 			$out->addHTML( Html::element( 'div', [ 'class' => 'error' ],
-				$this->msg( "cargo-unknowntable", $tableName )->parse() ) );
+				$this->msg( "cargo-unknowntable", $tableName )->escaped() ) );
 
 			return;
 		}
@@ -57,14 +57,14 @@ public function execute( $tableName ) {
 
 		if ( $req->getCheck( '_replacement' ) ) {
 			$pageTitle =
-				$this->msg( 'cargo-cargotables-viewreplacement', '"' . $tableName . '"' )->parse();
+				$this->msg( 'cargo-cargotables-viewreplacement', '"' . $tableName . '"' )->escaped();
 			$tableLink = Html::element( 'a', [ 'href' => $viewURL ], $tableName );
-			$text = $this->msg( 'cargo-cargotables-replacementtable', $tableLink )->text();
+			$text = $this->msg( 'cargo-cargotables-replacementtable' )->rawParams( $tableLink )->escaped();
 			if ( $user->isAllowed( 'recreatecargodata' ) ) {
 				$switchURL =
 					SpecialPage::getTitleFor( 'SwitchCargoTable' )->getFullURL() . "/$tableName";
 				$text .= ' ' . Html::element( 'a', [ 'href' => $switchURL ],
-						$this->msg( "cargo-cargotables-switch" )->parse() );
+						$this->msg( "cargo-cargotables-switch" )->escaped() );
 
 				if ( $user->isAllowed( 'deletecargodata' ) ) {
 					$deleteURL =
@@ -79,9 +79,9 @@ public function execute( $tableName ) {
 			$out->addHtml( Html::warningBox( $text ) );
 			$tableName .= '__NEXT';
 		} else {
-			$pageTitle = $this->msg( 'cargo-cargotables-viewtable', $tableName )->parse();
+			$pageTitle = $this->msg( 'cargo-cargotables-viewtable', $tableName )->escaped();
 			if ( CargoUtils::tableFullyExists( $tableName . '__NEXT' ) ) {
-				$text = Html::warningBox( $this->msg( 'cargo-cargotables-hasreplacement' )->parse() );
+				$text = Html::warningBox( $this->msg( 'cargo-cargotables-hasreplacement' )->escaped() );
 				$out->addHtml( $text );
 			}
 		}
@@ -100,7 +100,7 @@ public function execute( $tableName ) {
 		$fieldDescriptions = $tableSchemas[$tableName]->mFieldDescriptions;
 
 		// Display the table structure.
-		$structureDesc = '<p>' . $this->msg( 'cargo-cargotables-tablestructure' )->parse() . '</p>';
+		$structureDesc = '<p>' . $this->msg( 'cargo-cargotables-tablestructure' )->escaped() . '</p>';
 		$structureDesc .= '<ol>';
 		foreach ( $fieldDescriptions as $fieldName => $fieldDescription ) {
 			$fieldDesc = '<strong>' . $fieldName . '</strong> - ';
@@ -126,7 +126,7 @@ public function execute( $tableName ) {
 			$templateID = $templatesThatDeclareThisTable[0];
 			$templateTitle = Title::newFromID( $templateID );
 			$recreateDataURL = $templateTitle->getLocalURL( [ 'action' => 'recreatedata' ] );
-			$recreateDataMessage = $this->msg( 'recreatedata' )->parse();
+			$recreateDataMessage = $this->msg( 'recreatedata' )->escaped();
 			$recreateDataLink = Html::element( 'a', [ 'href' => $recreateDataURL ], $recreateDataMessage );
 			$out->addHTML( '<p>' . $recreateDataLink . '.</p>' );
 		}
@@ -512,7 +512,7 @@ private function displayListOfTables() {
 
 		$text .= Html::rawElement( 'p', null, $this->msg( 'cargo-cargotables-tablelist' )
 				->numParams( count( $tableNames ) )
-				->parse() ) . "\n";
+				->escaped() ) . "\n";
 
 		$headerText = Html::element( 'th', null, $this->msg( "cargo-cargotables-header-table" ) );
 		$headerText .= Html::element( 'th', null,
@@ -581,11 +581,13 @@ private function displayListOfTables() {
 
 		// Now display the table for the special Cargo tables.
 		$text .= '<br />';
-		$text .= Html::element( 'p', null, $this->msg( 'cargo-cargotables-specialtables' )->parse() );
+		$text .= Html::element( 'p', null, $this->msg( 'cargo-cargotables-specialtables' )->escaped() );
 		$specialTableNames = CargoUtils::specialTableNames();
 		$headerText = Html::element( 'th', null, $this->msg( "cargo-cargotables-header-table" ) );
 		$headerText .= Html::element( 'th', null,
-			$this->msg( "cargo-cargotables-header-rowcount" ) );
+			$this->msg( "cargo-cargotables-header-rowcount" )->escaped() );
+		$headerText .= Html::element( 'th', [ 'class' => 'cargotables-columncount' ],
+			$this->msg( "cargo-cargotables-header-columncount" )->escaped() );
 
 		$invalidActionsForSpecialTables = [ 'edit' ];
 		foreach ( $listOfColumns as $i => $action ) {

includes/specials/SpecialDeleteCargoTable.php

@@ -89,11 +89,11 @@ public function execute( $subpage = false ) {
 
 		if ( $this->getRequest()->getCheck( 'delete' ) ) {
 			self::deleteTable( $tableName, $fieldTables, $fieldHelperTables );
-			$text = Html::element( 'p', null, $this->msg( 'cargo-deletetable-success', $tableName )->parse() ) . "\n";
+			$text = Html::rawElement( 'p', null, $this->msg( 'cargo-deletetable-success', $tableName )->escaped() ) . "\n";
 			$tablesLink = CargoUtils::makeLink( $this->getLinkRenderer(),
 				$ctPage->getPageTitle(),
 				htmlspecialchars( $ctPage->getDescription() ) );
-			$text .= Html::rawElement( 'p', null, $this->msg( 'returnto', $tablesLink )->text() );
+			$text .= Html::rawElement( 'p', null, $this->msg( 'returnto' )->rawParams( $tablesLink )->escaped() );
 			$out->addHTML( $text );
 			if ( !$replacementTable ) {
 				CargoUtils::logTableAction( 'deletetable', $tableName, $this->getUser() );

includes/specials/SpecialSwitchCargoTable.php

@@ -121,15 +121,15 @@ public function execute( $subpage = false ) {
 			$text = Html::element( 'p', null, $this->msg( 'cargo-switchtables-success', $tableName )->parse() ) . "\n";
 			$tablesLink = CargoUtils::makeLink( $this->getLinkRenderer(),
 				$ctPage->getPageTitle(), $ctPage->getDescription() );
-			$text .= Html::rawElement( 'p', null, $this->msg( 'returnto', $tablesLink )->text() );
+			$text .= Html::rawElement( 'p', null, $this->msg( 'returnto' )->rawParams( $tablesLink )->escaped() );
 			$out->addHTML( $text );
 			return true;
 		}
 
 		$ctURL = $ctPage->getPageTitle()->getLocalURL();
 		$tableLink = Html::element( 'a', [ 'href' => "$ctURL/$tableName", ], $tableName );
 
-		$text = Html::rawElement( 'p', null, $this->msg( 'cargo-switchtables-confirm', $tableLink )->text() );
+		$text = Html::rawElement( 'p', null, $this->msg( 'cargo-switchtables-confirm' )->rawParams( $tableLink )->escaped() );
 		$out->addHTML( $text );
 
 		$htmlForm = HTMLForm::factory( 'ooui', [], $this->getContext() );