Manual:$wgUseXssLanguage/ja
| 言語、地域、文字エンコードの設定: $wgUseXssLanguage | |
|---|---|
| Whether to enable the x-xss language code, used to make checking for XSS issues more convenient. |
|
| 導入されたバージョン: | 1.41.0 (Gerrit change 959239; git #e9991ffb) |
| 除去されたバージョン: | 使用中 |
| 許容される値: | (boolean) |
| 既定値: | false (but true in DevelopmentSettings.php) |
| その他の設定: アルファベット順 | 機能順 | |
Details
Whether to enable the x-xss language code, used to make checking for XSS issues more convenient.
When this feature is enabled, the language code can be selected via the ?uselang=x-xss URL parameter.
In this fake language, every message becomes a simulated cross-site scripting attack, trying to run alert("message-key") JavaScript code; this simulates an attacker who can change individual messages (e.g. an administrator who can edit the MediaWiki namespace).
If any alert is shown in the browser, then the corresponding message was not escaped correctly; either the code using the message needs to be fixed, or the message key should be added to $wgRawHtmlMessages.