SLOP-374: escape ?page= reflection in Special:PageStatistics (reflected XSS)

[tosfos]

Summary

Special:PageStatistics (viewable by all users) echoed the raw ?page= request parameter into $wgOut->addHTML() when the requested title doesn't exist or isn't watchable:

$wgOut->addHTML( "<p>\"$requestedPage\" is either not a page or is not watchable</p>" );

A link like Special:PageStatistics?page=<img src=x onerror=alert(1)> executes attacker script in the wiki domain (classic reflected XSS). The fix escapes with htmlspecialchars( $requestedPage, ENT_QUOTES ) — the value still renders as text, but can no longer break out into markup.

Verification

• php -l clean on php:7.4-cli and php:8.2-cli.
• Harness on 8.2: OLD output contains raw <img ...> markup; NEW output contains only <img escaped form and zero raw tag openers.

Closes SLOP-374.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a05db2d-610f-4a3c-9d83-572dcb466a81

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}