Merge branch 'wikimedia-REL1_45' into REL1_45

Author: MacFan4000

RELEASE-NOTES-1.45

@@ -8,7 +8,7 @@ PHP 8.5 workboard: https://phabricator.wikimedia.org/tag/php_8.5_support/
 
 == MediaWiki 1.45.1 ==
 
-THIS IS NOT A RELEASE YET
+This is a security and maintenance release of the MediaWiki 1.45 branch.
 
 === Changes since 1.45.0 ===
 * Localisation updates.
@@ -20,14 +20,31 @@ THIS IS NOT A RELEASE YET
 * (T411968) Installer: Do not use null as array offset.
 * Add support for HTTP/3 in MultiHttpClient.
 * (T411968) EditResultBuilder: Do not use null as array offset.
+* Add http/3 to runMulti in MultiHttpClient
+* (T406639, CVE-2025-67477) SECURITY: Escape word-separator message in
+  Special:ApiSandbox.
+* (T406664, CVE-2025-67475) SECURITY: Escape square brackets in autocomment
+  links.
+* (T405859, CVE-2025-67476) SECURITY: Do not use importers IP in case of
+  external rev author.
+* (T385403, CVE-2025-67478) SECURITY: Always escape commas in mail
+  encoded-words.
+* (T407131, CVE-2025-67479) SECURITY: Sanitizer: disallow underscore and wide
+  underscore in data-* attribute names.
+* (T401053, CVE-2025-67480) SECURITY: Check read permissions in
+  ApiQueryRevisionsBase.
+* (T409226, CVE-2025-67483) SECURITY: mediawiki.page.preview: Escape
+  'comma-separator' between multiple protection levels.
+* (T251032, CVE-2025-67481) SECURITY: Disallow 'style' attribute in client-side
+  messages (jqueryMsg).
 
 == MediaWiki 1.45.0 ==
 
 === Changes since MediaWiki 1.45.0-rc.0 ===
 * Localisation updates.
 * (T410913) SpecialVersion: Fix "Cannot use bool as array" warning.
 * (T410928) resourceloader: Fix null offset in ClientHtml module sorting.
-* (T401987, T401995) SECURITY: Disable xslt option by default.
+* (T401987, T401995, CVE-2025-67484) SECURITY: Disable xslt option by default.
 * (T410934) Remove noop xml_parser_free() calls.
 * (T405450) session: Use fresh MW services container in CLI mode.
 * (T410912) MessageCache: Fix PHP 8.5 warning from ord().

includes/Defines.php

@@ -20,7 +20,7 @@
  *
  * @since 1.35 (also backported to 1.33.3 and 1.34.1)
  */
-define( 'MW_VERSION', '1.45.0' );
+define( 'MW_VERSION', '1.45.1' );
 
 /** @{
  * Obsolete IDatabase::makeList() constants

includes/parser/CoreParserFunctions.php

@@ -1363,7 +1363,9 @@ public static function padright( $parser, $string = '', $length = '0', $padding
 	public static function anchorencode( $parser, $text ) {
 		$text = $parser->killMarkers( $text );
 		$section = substr( $parser->guessSectionNameFromWikiText( $text ), 1 );
-		return Sanitizer::safeEncodeAttribute( $section );
+		$encodedSection = Sanitizer::safeEncodeAttribute( $section );
+		// decode underscores to avoid breaking templates (T407131)
+		return str_replace( '_', '_', $encodedSection );
 	}
 
 	/**

includes/parser/Sanitizer.php

@@ -501,8 +501,10 @@ public static function validateAttributes( array $attribs, array $allowed ): arr
 			# * Ensure attribute name will be accepted by the HTML
 			#   parser; see
 			#   https://github.com/whatwg/dom/issues/849#issuecomment-1007541209
+			# * Underscore and double-wide underscore (U+FF3F) is disallowed
+			#   here (but not in Parsoid): T407131
 			if ( (
-				!preg_match( '|^data-[^:= \t\r\n/>\0]*$|i', $attribute ) &&
+				!preg_match( '|^data-[^:= \t\r\n/>\0_＿]*$|i', $attribute ) &&
 				!array_key_exists( $attribute, $allowed )
 			) || self::isReservedDataAttribute( $attribute ) ) {
 				continue;
@@ -852,7 +854,8 @@ public static function safeEncodeAttribute( string $text ): string {
 			'RFC'  => 'RFC',
 			'PMID' => 'PMID',
 			'|'    => '|',
-			'__'   => '__',
+			'_'    => '_',
+			'＿'    => '＿', // Japanese magic words
 		] );
 
 		# Stupid hack

tests/parser/headings.txt

@@ -2391,7 +2391,7 @@ parsoid=wt2html,html2html
 {| STYLE=__TOC__
 !! html/php
 <div class="mw-heading mw-heading2"><h2 id="a">a</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=1" title="Edit section: a">edit</a><span class="mw-editsection-bracket">]</span></span></div>
-<table style="&#95;_TOC&#95;_">
+<table style="&#95;&#95;TOC&#95;&#95;">
 <tbody><tr><td></td></tr>
 </tbody></table>
 !! html/parsoid

tests/parser/parserTests.txt

@@ -9437,7 +9437,7 @@ wgFragmentMode=[ "html5", "legacy" ]
 !! wikitext
 <span id="æ: v">byte</span>[[#æ: v|backlink]]
 !! html/php
-<p><span id="æ:_v">byte</span><a href="#æ:_v">backlink</a>
+<p><span id="æ:&#95;v">byte</span><a href="#æ:_v">backlink</a>
 </p>
 !! html/parsoid
 <p><span id="æ:_v" data-parsoid='{"stx":"html","a":{"id":"æ:_v"},"sa":{"id":"æ: v"}}'>byte</span><a rel="mw:WikiLink" href="./Main_Page#æ:_v" class="mw-selflink-fragment" data-parsoid='{"stx":"piped","a":{"href":"./Main_Page#æ:_v"},"sa":{"href":"#æ: v"}}'>backlink</a></p>
@@ -9450,7 +9450,7 @@ wgFragmentMode=[ "legacy" ]
 !! wikitext
 <span id="æ: v">byte</span>[[#æ: v|backlink]]
 !! html/php
-<p><span id=".C3.A6:_v">byte</span><a href="#.C3.A6:_v">backlink</a>
+<p><span id=".C3.A6:&#95;v">byte</span><a href="#.C3.A6:_v">backlink</a>
 </p>
 !! end
 
@@ -9463,7 +9463,7 @@ parsoid=wt2html,html2html
 !! wikitext
 <br id="" /><br id="a space" />
 !! html/php
-<p><br /><br id="a_space" />
+<p><br /><br id="a&#95;space" />
 </p>
 !! html/parsoid
 <p><br data-parsoid='{"stx":"html","selfClose":true,"a":{"id":null},"sa":{"id":""}}'/><br id="a_space" data-parsoid='{"stx":"html","selfClose":true,"a":{"id":"a_space"},"sa":{"id":"a space"}}'/></p>
@@ -12447,7 +12447,7 @@ Id starting with underscore
 !! wikitext
 <div id="_ref"></div>
 !! html/*
-<div id="_ref"></div>
+<div id="&#95;ref"></div>
 !! end
 
 !! test
@@ -12826,7 +12826,7 @@ HTML5 data attributes
 !! html/php
 <p><span data-foo="bar">Baz</span>
 </p>
-<p data-abc-def_hij="">Quuz</p>
+<p>Quuz</p>
 !! html/parsoid
 <p><span data-foo="bar" data-parsoid='{"stx":"html"}'>Baz</span></p>
 <p data-abc-def_hij="" data-parsoid='{"stx":"html"}'>Quuz</p>