[00:59:36] <.labster, replying to raidarr> Do you remember what the specific reason Widgets was removed? [01:00:20] It had XSS security issues [01:00:34] we love xsss [01:01:21] <.labster> Xsses [01:01:21] Xross Site Scripting [01:01:21] Xoxo gossip girl [01:01:21] We shpuld just call it CSS [01:01:24] <.labster> Raidxrr [01:01:35] both are similarly evil [01:01:42] <.labster> Raidxss [01:02:48] <.labster> Was it a core architecture XSS, or one of the widgets? [01:03:51] [1/4] I'm off to bed people. [01:03:51] [2/4] Have a nice evening, morning, or whatever. [01:03:52] [3/4] 💤 [01:03:52] [4/4] 🛌 [01:03:52] Its a yaron extension so i would assume its entire premise is a security flaw [01:04:09] https://meta.miraheze.org/wiki/2020-12-23_Security_Disclosure for reference [01:05:52] <.labster, replying to originalauthority> Unfortunately that page is zero context for me [01:06:47] 🤷🏼‍♂️ the actual issue was never disclosed from mirahezes side i dont think [01:07:30] The ticket on Phab is private [01:07:31] <.labster> Now you’re just making me angry [01:07:59] https://phabricator.wikimedia.org/T270286 [01:08:00] <.labster> 900 day responsible disclosure [01:18:27] <.labster> [1/3] > I'd suggest this bug be closed as DECLINED. [01:18:27] <.labster> [2/3] > The entire point of the widget extension is to allow arbitrary html. [01:18:28] <.labster> [3/3] Bawolff is right [01:19:34] <.labster> On the other hand I’m not sure it belongs in our security model. [01:24:34] Well before my time [01:25:14] Does it have XSS by its own existence, or only if the widget itself isn't secure? Cause if it's any consolation, my widget specifically uses dropdowns so folks can't input shit that shouldn't be input. Lol [01:27:37] <.labster> It sounds like it’s easy to use incorrectly, which I guess could be an argument for case-by-case approval [01:28:02] Yeah that's how it appeared on the extension description page. [01:28:29] <.labster> Could your code be reimplemented as a Gadget instead? [01:32:07] [1/3] I've been looking into how I might do that.. the widget is nice cause all it is is the widget file itself which is html and