Tag
#git
Email is still the backbone of how businesses communicate, with more than 300 billion messages sent every day.…
### Summary Page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. ### Details The descriptions, which are unsanitized, are inserted as raw HTML: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d4dfc3697a82948b3b9c4d44e9a273c79bc86b87/resources/skins.citizen.search/templates/TypeaheadListItem.mustache#L18 ### PoC All of the reproduction methods require the command palette to be disabled via `$wgCitizenEnableCommandPalette = false;`. Additionally, the action API must be used as the Search Gateway via `$wgCitizenSearchGateway = 'mwActionApi';`. #### TextExtracts as the description source * Enable the TextExtracts extension * Add `$wgCitizenSearchDescriptionSource = 'textextracts';` to your LocalSettings.php * Create a page called `CitizenXSSTextExtracts` and insert `<img src="" onerror="alert('citizen search xss')">` into it * Open the search modal and search for `CitizenXSSTextExtracts` . All users should upgrade to this version or later. The fix introduces strict checking of URI patterns. Patch commit: https://github.com/n8n-io/n8n/pull/16229