MediaWiki will sanitize tags it does not recognize. Unless you find a flaw in the sanitizer, you can't put a working <script> in a message string. On 1/22/12 10:26 PM, Roan Kattouw wrote: It already does escaping, it just trusts jQuery to do it. So a string that doesn't "look" like HTML is already escaped just fine. But if it does look like HTML, for convenience' sake, it gets turned into jQuery. Since it's a frontend library, we have a lot less to worry about. The one case I see is when we have non-sanitized, user-contributed data, that we got from the server, used in HTML parameters. Like, someone saying their first name is '<script src="evil.js"></script>'. The whole point of the library is to allow you to pass in jQuery objects into a message. But, we could make that safer: 1 - Right now, the library allows you to pass HTML in a string, as a convenience. We could instead make it that all strings are assumed to be Just Strings, and escape them on the way in. So you couldn't use '<b>foo</b>' as a parameter, you'd have to declare your intention that it should be HTML by passing a real jQuery object. This may break old code in a few places, but not many. 2 - We could ensure that the message library never emits scripts, by applying a simple jQuery filter to the final result. -- Neil Kandalgaonkar &lt;neilk(a)wikimedia.org&gt;

On 24 January 2012 06:59, Daniel Friesen &lt;lists(a)nadir-seen-fire.com&gt; wrote: .. What about using textNodes? http://stackoverflow.com/questions/476821/is-a-dom-text-node-guaranteed-to-… -- -- ℱin del ℳensaje.

On 24 January 2012 15:57, Daniel Friesen &lt;lists(a)nadir-seen-fire.com&gt; wrote: People on the internet suggest something like $("<div/>").text( "<script>alert('lets do evil!')</script>" ).html(); postdata: Some random code I just wrote. var Stringbuilder = (function(){ var text = []; return { add:function(txt){ text.push(txt); return this;}, encode:function(txt){ text.push( new String( $("<div/>").text( txt ).html() ) ); return this;}, toString:function() { return text.join(""); } }; }); var str = Stringbuilder(); str.add("<table>") . add("<tr>") . add("<td>") . encode("<script>alert('lets do evil!)</script>") . add("</td>") . add("</tr>") . add("</table>"); str.toString(); -- -- ℱin del ℳensaje.

On 1/23/12 9:59 PM, Daniel Friesen wrote: Thanks for the pointer. You're right, I wasn't being careful enough. Even so I think we have some reason for limited optimism in this case, because jQuery operates on nodes in browser, not strings on the server. Adding something to a DOM usually normalizes it, so there's less chance of missing something due to unusual ways of encoding, escaping, or delimiting input. As far as I know these are the main dangers: - SCRIPT, STYLE tags - LINK, IFRAME, FRAME, FRAMESET, META, OBJECT, EMBED tags - inherently scripted attributes, such as "onclick". - attribute values beginning with 'javascript:', 'vbscript:', 'mocha:', 'livescript:', matched case-insensitively. - hardest one: element styles with values that, once cleaned of comments, contain the script words above or /expression(.*)/ However there are other dangers too. Yesterday I discovered that in Chrome, a script will be executed if you .append() it to anything, even if it's not part of the document. Annoying. Anyway I'm not going to war on this, but some reasonable efforts can be made. -- Neil Kandalgaonkar &lt;neilk(a)wikimedia.org&gt;