SECURITY: API: Don't find links in the middle of api.php links

Bug: 61362
Change-Id: Idf985e4e69c2f11778a8a90503914678441cb3fb

diff --git a/includes/api/ApiFormatBase.php b/includes/api/ApiFormatBase.php
index 63a5502..49a02fe 100644 (file)
--- a/includes/api/ApiFormatBase.php
+++ b/includes/api/ApiFormatBase.php
@@ -271,12 +271,22 @@ See the <a href='https://www.mediawiki.org/wiki/API'>complete documentation</a>,
                // encode all comments or tags as safe blue strings
                $text = str_replace( '&lt;', '<span style="color:blue;">&lt;', $text );
                $text = str_replace( '&gt;', '&gt;</span>', $text );
+
                // identify requests to api.php
-               $text = preg_replace( "#api\\.php\\?[^ <\n\t]+#", '<a href="\\0">\\0</a>', $text );
+               $text = preg_replace( '#^(\s*)(api\.php\?[^ <\n\t]+)$#m', '\1<a href="\2">\2</a>', $text );
                if ( $this->mHelp ) {
                        // make strings inside * bold
                        $text = preg_replace( "#\\*[^<>\n]+\\*#", '<b>\\0</b>', $text );
                }
+
+               // Armor links (bug 61362)
+               $masked = array();
+               $text = preg_replace_callback( '#<a .*?</a>#', function ( $matches ) use ( &$masked ) {
+                       $sha = sha1( $matches[0] );
+                       $masked[$sha] = $matches[0];
+                       return "<$sha>";
+               }, $text );
+
                // identify URLs
                $protos = wfUrlProtocolsWithoutProtRel();
                // This regex hacks around bug 13218 (&quot; included in the URL)
@@ -286,6 +296,12 @@ See the <a href='https://www.mediawiki.org/wiki/API'>complete documentation</a>,
                        $text
                );
 
+               // Unarmor links
+               $text = preg_replace_callback( '#<([0-9a-f]{40})>#', function ( $matches ) use ( &$masked ) {
+                       $sha = $matches[1];
+                       return isset( $masked[$sha] ) ? $masked[$sha] : $matches[0];
+               }, $text );
+
                /**
                 * Temporary fix for bad links in help messages. As a special case,
                 * XML-escaped metachars are de-escaped one level in the help message