Summary

The CheckUser extension has Special:Investigate which is currently vulnerable to i18n XSS (through checking with the x-xss language). These XSS vectors should be fixed.

Background

• The x-xss language allows finding messages which are not properly escaped in MediaWiki interfaces
• The CheckUser extension has Special:Investigate for investigating users to see if they have performed abuse
• When using the x-xss language on Special:Investigate, there are several popup alerts that indicate the CheckUser is not properly escaping these messages
• The messages which are vulnerable:
  • checkuser-investigate-compare-table-cell-unregistered
  • rev-deleted-user

Technical notes

To reproduce:

1. Set $wgUseXssLanguage to be true
2. Create a user which is then suppressed
3. Perform a few edits using an IP address (not temporary account)
4. Load Special:Investigate and enter the IP used to perform steps 2 and 3
5. Enter a reason and submit the form
6. Add uselang=x-xss to the end of the URL when on IPs and User agents tab

Screenshots

Acceptance criteria

• The CheckUser Special:Investigate IPs and User agents tab is no longer vulnerable to i18n XSS