function extlink() {
				var result, parsedResult, target;
				result = null;
				parsedResult = sequence( [
					openExtlink,
					nOrMore( 1, nonWhitespaceExpression ),
					whitespace,
					nOrMore( 1, expression ),
					closeExtlink
				] );

mw.message('testmsg').params( [ 'https://example.org' ] ).parse()
"Hello <a href="https://example.org">world</a>"
mw.message('testmsg').params( [ '//example.org' ] ).parse()
"Hello <a href="//example.org">world</a>"
mw.message('testmsg').params( [ '/wiki/Foo' ] ).parse()
"Hello [/wiki/Foo world]"

diff --git a/resources/src/mediawiki.jqueryMsg/mediawiki.jqueryMsg.js b/resources/src/mediawiki.jqueryMsg/mediawiki.jqueryMsg.js
index 26a1d93b9d..0d51e83c08 100644
--- a/resources/src/mediawiki.jqueryMsg/mediawiki.jqueryMsg.js
+++ b/resources/src/mediawiki.jqueryMsg/mediawiki.jqueryMsg.js
@@ -1256,7 +1256,7 @@ mw.jqueryMsg.HtmlEmitter.prototype = {
 } );
 } else {
 target = textify( arg );
- if ( target.search( new RegExp( '^(' + mw.config.get( 'wgUrlProtocols' ) + ')' ) ) !== -1 ) {
+ if ( target.search( new RegExp( '^(/|' + mw.config.get( 'wgUrlProtocols' ) + ')' ) ) !== -1 ) {
 $el.attr( 'href', target );
 } else {
 mw.log( 'External link in message had illegal target ' + target );
diff --git a/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js b/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
index 51e32b5bc9..bc49b67dae 100644
--- a/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
+++ b/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
@@ -1179,16 +1179,15 @@
 
 this.suppressWarnings();
 
- assert.equal(
+ assert.strictEqual(
 formatParse( 'illegal-url' ),
 '[javascript:alert(1) foo]',
 'illegal-url: \'parse\' format'
 );
 
- assert.equal(
- /* jshint scripturl: true */
+ assert.strictEqual(
+ // eslint-disable-next-line no-script-url
 formatParse( 'illegal-url-param', 'javascript:alert(1)' ),
- /* jshint scripturl: false */
 '[javascript:alert(1) foo]',
 'illegal-url-param: \'parse\' format'
 );
@@ -1199,7 +1198,7 @@
 
 this.suppressWarnings();
 
- assert.equal(
+ assert.strictEqual(
 formatParse( 'illegal-style' ),
 '<span style="background-image:url( http://example.com )">bar</span>',
 'illegal-style: \'parse\' format'

diff --git a/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js b/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
index bc49b67dae..7f214211ab 100644
--- a/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
+++ b/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
@@ -620,6 +620,16 @@
 'Foo <a href="http://example.com">bar</a>',
 'External link message processed when format is \'parse\''
 );
+ assert.htmlEqual(
+ formatParse( 'external-link-replace', '/wiki/Special:Version' ),
+ 'Foo <a href="/wiki/Special:Version">bar</a>',
+ 'External link message allows relative URL when processed'
+ );
+ assert.htmlEqual(
+ formatParse( 'external-link-replace', '//example.com' ),
+ 'Foo <a href="//example.com">bar</a>',
+ 'External link message allows protocol-relative URL when processed'
+ );
 assert.htmlEqual(
 formatParse( 'external-link-replace', $( '<i>' ) ),
 'Foo <i>bar</i>',

From 334a6b807d388c8b1ad3f313038a59db356601e3 Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Tue, 27 Oct 2015 01:39:34 -0600
Subject: [PATCH] SECURITY: mediawiki.jqueryMsg: Sanitize URLs and 'style'
 attribute

Previously you could leverage the style attribute, and external
links to execute javascript.

Bug: T86738
Change-Id: I6f15ece1db136369e06dfeee34d1a0c5bc03e32b
Co-Authored-By: Roan Kattouw <roan.kattouw@gmail.com>
Co-Authored-By: Lucas Werkmeister <lucas.werkmeister@wikimedia.de>
---
 .../src/mediawiki/mediawiki.jqueryMsg.js | 22 ++++++++--
 .../mediawiki/mediawiki.jqueryMsg.test.js | 42 +++++++++++++++++++
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/resources/src/mediawiki/mediawiki.jqueryMsg.js b/resources/src/mediawiki/mediawiki.jqueryMsg.js
index 67d6e2c5f5..93623d8c27 100644
--- a/resources/src/mediawiki/mediawiki.jqueryMsg.js
+++ b/resources/src/mediawiki/mediawiki.jqueryMsg.js
@@ -695,7 +695,7 @@
 			 * @return {boolean} true if this is HTML is allowed, false otherwise
 			 */
 			function isAllowedHtml( startTagName, endTagName, attributes ) {
-				var i, len, attributeName;
+				var i, len, attributeName, badStyle;
 
 				startTagName = startTagName.toLowerCase();
 				endTagName = endTagName.toLowerCase();
@@ -703,12 +703,18 @@
 					return false;
 				}
 
+				badStyle = /[\000-\010\013\016-\037\177]|expression|filter\s*:|accelerator\s*:|-o-link\s*:|-o-link-source\s*:|-o-replace\s*:|url\s*\(|image\s*\(|image-set\s*\(/i;
+
 				for ( i = 0, len = attributes.length; i < len; i += 2 ) {
 					attributeName = attributes[ i ];
 					if ( settings.allowedHtmlCommonAttributes.indexOf( attributeName ) === -1 &&
 						( settings.allowedHtmlAttributesByElement[ startTagName ] || [] ).indexOf( attributeName ) === -1 ) {
 						return false;
 					}
+					if ( attributeName === 'style' && attributes[ i + 1 ].search( badStyle ) !== -1 ) {
+						mw.log( 'HTML tag not parsed due to dangerous style attribute' );
+						return false;
+					}
 				}
 
 				return true;
@@ -1138,7 +1144,8 @@
 		extlink: function ( nodes ) {
 			var $el,
 				arg = nodes[ 0 ],
-				contents = nodes[ 1 ];
+				contents = nodes[ 1 ],
+				target;
 			if ( arg instanceof jQuery && !arg.hasClass( 'mediaWiki_htmlEmitter' ) ) {
 				$el = arg;
 			} else {
@@ -1156,7 +1163,16 @@
 						}
 					} );
 				} else {
-					$el.attr( 'href', textify( arg ) );
+				target = textify( arg );
+					if ( target.search( new RegExp( '^(/|' + mw.config.get( 'wgUrlProtocols' ) + ')' ) ) !== -1 ) {
+						$el.attr( 'href', target );
+					} else {
+						mw.log( 'External link in message had illegal target ' + target );
+						return appendWithoutParsing(
+							$( '<span>' ),
+							[ '[' + target + ' ' ].concat( contents ).concat( ']' )
+						).contents();
+					}
 				}
 			}
 			return appendWithoutParsing( $el.empty(), contents );
diff --git a/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js b/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
index 0653dfd3d0..7e3348326a 100644
--- a/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
+++ b/tests/qunit/suites/resources/mediawiki/mediawiki.jqueryMsg.test.js
@@ -657,6 +657,16 @@
 			'Foo <a href="http://example.com">bar</a>',
 			'External link message processed when format is \'parse\''
 		);
+		assert.htmlEqual(
+			formatParse( 'external-link-replace', '/wiki/Special:Version' ),
+			'Foo <a href="/wiki/Special:Version">bar</a>',
+			'External link message allows relative URL when processed'
+		);
+		assert.htmlEqual(
+			formatParse( 'external-link-replace', '//example.com' ),
+			'Foo <a href="//example.com">bar</a>',
+			'External link message allows protocol-relative URL when processed'
+		);
 		assert.htmlEqual(
 			formatParse( 'external-link-replace', $( '<i>' ) ),
 			'Foo <i>bar</i>',
@@ -1153,6 +1163,38 @@
 		assert.equal( logSpy.callCount, 2, 'mw.log.warn calls' );
 	} );
 
+	QUnit.test( 'Do not allow javascript: urls', function ( assert ) {
+		mw.messages.set( 'illegal-url', '[javascript:alert(1) foo]' );
+		mw.messages.set( 'illegal-url-param', '[$1 foo]' );
+
+		this.suppressWarnings();
+
+		assert.strictEqual(
+			formatParse( 'illegal-url' ),
+			'[javascript:alert(1) foo]',
+			'illegal-url: \'parse\' format'
+		);
+
+		assert.strictEqual(
+			// eslint-disable-next-line no-script-url
+			formatParse( 'illegal-url-param', 'javascript:alert(1)' ),
+			'[javascript:alert(1) foo]',
+			'illegal-url-param: \'parse\' format'
+		);
+	} );
+
+	QUnit.test( 'Do not allow arbitrary style', function ( assert ) {
+		mw.messages.set( 'illegal-style', '<span style="background-image:url( http://example.com )">bar</span>' );
+
+		this.suppressWarnings();
+
+		assert.strictEqual(
+			formatParse( 'illegal-style' ),
+			'&lt;span style="background-image:url( http://example.com )"&gt;bar&lt;/span&gt;',
+			'illegal-style: \'parse\' format'
+		);
+	} );
+
 	QUnit.test( 'Integration', function ( assert ) {
 		var expected, logSpy, msg;
 
-- 
2.25.1