Page MenuHomePhabricator

Uncensor use of "filter" CSS property on wikitext pages
Closed, ResolvedPublicFeature

Description

Feature summary (what you would like to be able to do and where):
Allow usage of the filter CSS property on pages with a content model other than sanitized-css. Specifically, in the style attribute of elements.

Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):
I tried to make the Ditto sprite in a userbox at bulba:User:Bfdifan2006 yellow by wrapping it with a div whose filter is hue-rotate(135deg), but MediaWiki blocked the property stating it's insecure (by changing it to /* insecure input */. I actually commented it out in the wikitext.

Benefits (why should this be implemented?):
This could come useful for wikis that are a bit too reluctant to adopt TemplateStyles, and also for users that are a bit confused about the extension's functionality.

This was blocked in 2010 for security reasons since at that time, Internet Explorer had its own insecure version of filter that was unrelated to the later W3C property (more information), but the IE property was deprecated in version 9 and removed from the core in version 10. The browser is going to lose Microsoft support soon due to the success of the Blink-based Microsoft Edge.

It was not a W3C-compatible property, it used a different syntax. However, the W3C-compatible property is safe.

A showcase of this property failing can be found here.

Event Timeline

Keyacom renamed this task from Uncensor use of "filter" CSS property on wikitext and plain text pages to Uncensor use of "filter" CSS property on wikitext pages.May 11 2022, 4:32 PM

Not exactly. I am talking about its use in the style attribute on wikitext pages, not on sanitized-css pages.

Also, yes, I did forget to assign this to projects, but it's because I didn't know which projects it should be assigned to.

Izno subscribed.

filter is explicitly disallowed in Sanitizer::checkCSS. I think this request should be rejected.

I don't think it should be. The filter property should be allowed, but I think you're concerned about the url() value, which should remain censored.

I do need to use the filter and backdrop-filter properties, I'm for this; and if we are concerning about url(), it's already blocked anyway.

I agree that IE9 is very irrelevant. It should be noted, this is not just about -ms-filter, as older versions of IE also accepted filter without the -ms- prefix.

The discussion around adding filter to the blacklist is at https://static-codereview.wikimedia.org/MediaWiki/66990.html . Definitely valid reasons at the time, but not really relevant anymore.

I support removing filter: from the blacklist (We should still ban url(). We should also be banning src() which i don't think anyone has implemented yet.

[tagging security. I'm sure they would want input on potential changes to the sanitizer]

As pointed out elsewhere by stjn, IE8 does not support TLS1.2 by default, so its not just that nobody uses this browser, but even if they did, they would not be able to load WMF sites.

Change 1001280 had a related patch set uploaded (by Brian Wolff; author: Brian Wolff):

[mediawiki/core@master] Allow filter: in inline CSS.

https://gerrit.wikimedia.org/r/1001280

Change 1001280 merged by jenkins-bot:

[mediawiki/core@master] Allow filter: in inline CSS.

https://gerrit.wikimedia.org/r/1001280

Hello @Bawolff, for Tech News - What wording would you suggest as the content, and When should it be included? Thanks!

"The CSS filter keyword can now be used in html style attributes in wikitext".

This patch rides the train (1.42.0-wmf19). It should go out next week i suppose.

"The CSS filter keyword can now be used in html style attributes in wikitext".

This patch rides the train (1.42.0-wmf19). It should go out next week i suppose.

Thank you!

Winston_Sung added a project: Parsoid.

Looks like we missed the Parsoid part.

Change 1010995 had a related patch set uploaded (by Arlolra; author: Arlolra):

[mediawiki/services/parsoid@master] Allow filter: in inline CSS

https://gerrit.wikimedia.org/r/1010995

Change 1010995 merged by jenkins-bot:

[mediawiki/services/parsoid@master] Allow filter: in inline CSS

https://gerrit.wikimedia.org/r/1010995

Change 1011398 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):

[mediawiki/vendor@master] Bump wikimedia/parsoid to 0.19.0-a23

https://gerrit.wikimedia.org/r/1011398

Change 1011398 merged by jenkins-bot:

[mediawiki/vendor@master] Bump wikimedia/parsoid to 0.19.0-a23

https://gerrit.wikimedia.org/r/1011398