From: csteipp <csteipp@wikimedia.org>
Date: Mon, 15 Apr 2013 20:42:02 +0000 (-0700)
Subject: Sanitize $limitReport before outputting
X-Git-Tag: 1.31.0-rc.0~19998^2
X-Git-Url: http://git.cyclocoop.org/%7B%24www_url%7Dadmin/compta/exercices/?a=commitdiff_plain;h=69f96f65dd99e54b84e489e7d957b7526653474c;p=lhc%2Fweb%2Fwiklou.git

Sanitize $limitReport before outputting

Prevents possible injection of "-->" and other HTML by extensions using
the ParserLimitReport hook.

bug: 46084
Change-Id: Id97b6668da6df3e5e4c0acefffa00c82cac3c44a
---

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index 0247d3e143..3ada925a14 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -501,6 +501,11 @@ class Parser {
 				"Highest expansion depth: {$this->mHighestExpansionDepth}/{$this->mOptions->getMaxPPExpandDepth()}\n" .
 				$PFreport;
 			wfRunHooks( 'ParserLimitReport', array( $this, &$limitReport ) );
+
+			// Sanitize for comment. Note '‐' in the replacement is U+2010,
+			// which looks much like the problematic '-'.
+			$limitReport = str_replace( array( '-', '&' ), array( '‐', '&amp;' ), $limitReport );
+
 			$text .= "\n<!-- \n$limitReport-->\n";
 
 			if ( $this->mGeneratedPPNodeCount > $this->mOptions->getMaxGeneratedPPNodeCount() / 10 ) {