From e92f3863db694b3ef3f6f0bfb0b423b3bd59d026 Mon Sep 17 00:00:00 2001
From: Ike Hecht <tosfos@users.noreply.github.com>
Date: Sat, 22 Aug 2026 23:38:14 -0400
Subject: [PATCH] SLOP-374: escape ?page= reflection in Special:PageStatistics
 (reflected XSS)

The not-a-page error message interpolated the raw request parameter
into addHTML; escape it with htmlspecialchars(ENT_QUOTES).
---
 specials/SpecialPageStatistics.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/specials/SpecialPageStatistics.php b/specials/SpecialPageStatistics.php
index a7a6186..26f3d50 100644
--- a/specials/SpecialPageStatistics.php
+++ b/specials/SpecialPageStatistics.php
@@ -49,7 +49,7 @@ public function execute( $parser = null ) {
 			$this->renderPageStats();
 		} elseif ( $requestedPage ) {
 			// @todo FIXME: internationalize
-			$wgOut->addHTML( "<p>\"$requestedPage\" is either not a page or is not watchable</p>" );
+			$wgOut->addHTML( '<p>"' . htmlspecialchars( $requestedPage, ENT_QUOTES ) . '" is either not a page or is not watchable</p>' );
 		} else {
 			$wgOut->addHTML( "<p>No page requested</p>" );
 		}