GHSA-9rcc-pmj8-ffhr

### Summary Special:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354) ### Details #### Affected versions and vulnerable location - Confirmed present on latest shipped release tag available in the local clone: `SemanticMediaWiki/[email protected]`. - Confirmed present on default branch `master` at HEAD `18f418b4cdf2875e67a741349179a22c1573f61c`. Vulnerable sink (default-branch representation): - `src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133` - Builds `$hidden` by concatenating unescaped request-controlled `cstate[$key]` values into an HTML attribute context (`value="..."`). - `templates/FacetedSearch/search.mustache:25` - Inserts the constructed fragment via `{{{hidden}}}` (no HTML escaping at this boundary). #### Reachability trace (verified from source) 1. HTTP entrypoint: - `GET` to `Special:FacetedSearch` dispatches into `SMW\MediaWiki\Specials\SpecialFacetedSearch::execute()`. 2. Request decoding boundary: - `SpecialFacetedSearch::execute()` constructs `UrlArgs` from `$request->getValues()` and calls `ParametersProcessor::checkRequest($request)`. 3. Checksum gate: - `ParametersProcessor::checkRequest()` clears `cstate` only when `filtered != 1` and `getInt('csum', 0) != crc32(getVal('q', ''))`. 4. Decoder -> HTML assembly: - `HtmlBuilder::buildHTML()` iterates `foreach ( $urlArgs->getArray( 'cstate' ) as $key => $value )` and concatenates each into `$hidden` without escaping. - `HtmlBuilder::buildHTML()` passes `$hidden` into the template variable `hidden`. 5. HTML injection sink: - `templates/FacetedSearch/search.mustache` renders `{{{hidden}}}` into the `<form>`, so the concatenated markup is inserted as raw HTML. ### PoC #### Reproduction steps (source-derived) 1. Choose a `q` value. 2. Compute `csum` as `crc32(q)`. 3. Send a request that includes: - `q=<chosen>` - `csum=<crc32(q)>` - at least one `cstate[<key>]=<payload>` entry Example request shape: ```tex