- notifications - lists.xwiki.org

[xwiki/xwiki-platform] 56f63d: XWIKI-24352: Bad escaping in WikiManager pages
by XWiki Notifications 20 May '26

20 May '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 56f63dc26c4af81d7b8dbd6b357982ed51d6b01f https://github.com/xwiki/xwiki-platform/commit/56f63dc26c4af81d7b8dbd6b3579… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-05-20 (Wed, 20 May 2026) Changed paths: M xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/WikiActivityServiceCode.xml Log Message: ----------- XWIKI-24352: Bad escaping in WikiManager pages To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[jira@xwiki.org][Issue] Updates for XCOMMONS-3662: Static service cache retains old extension class instances after classloader reload, causing ClassCastException
by XWiki Notifications 20 May '26

20 May '26

1 0

[jira@xwiki.org][Issue] Updates for XCOMMONS-3662: Static service cache retains old extension class instances after classloader reload, causing ClassCastException
by XWiki Notifications 20 May '26

20 May '26

1 0

[xwiki/xwiki-platform]
by XWiki Notifications 20 May '26

20 May '26

Branch: refs/heads/stable-18.3.x Home: https://github.com/xwiki/xwiki-platform To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-rendering]
by XWiki Notifications 20 May '26

20 May '26

Branch: refs/heads/stable-18.3.x Home: https://github.com/xwiki/xwiki-rendering To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-rendering/settings/notifications

1 0

[xwiki/xwiki-commons]
by XWiki Notifications 20 May '26

20 May '26

Branch: refs/heads/stable-18.3.x Home: https://github.com/xwiki/xwiki-commons To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-commons/settings/notifications

1 0

[jira@xwiki.org][Issue] Updates for XWIKI-23953: Guest user can import a XAR through the /wikis/{wikiName} REST endpoint
by XWiki Notifications 20 May '26

20 May '26

1 0

[jira@xwiki.org][Issue] Updates for XCOMMONS-3547: Path traversal via resources parameter in ssx and jsx enpoints - incomplete CVE-2025-55748 fix
by XWiki Notifications 20 May '26

20 May '26

1 0

[xwiki/xwiki-platform] 5bfdb1: [SECURITY] Validate CaptchaEngine type before dyna...
by XWiki Notifications 20 May '26

20 May '26

Branch: refs/heads/claude/magical-faraday-9otsF Home: https://github.com/xwiki/xwiki-platform Commit: 5bfdb14445d48e297b1cc8a4b24f5e7ae8b5ac2b https://github.com/xwiki/xwiki-platform/commit/5bfdb14445d48e297b1cc8a4b24f… Author: Claude <noreply(a)anthropic.com> Date: 2026-05-20 (Wed, 20 May 2026) Changed paths: M xwiki-platform-core/xwiki-platform-captcha/xwiki-platform-captcha-api/src/main/java/org/xwiki/captcha/CaptchaException.java M xwiki-platform-core/xwiki-platform-captcha/xwiki-platform-captcha-jcaptcha/xwiki-platform-captcha-jcaptcha-api/src/main/java/org/xwiki/captcha/internal/CaptchaServiceManager.java A xwiki-platform-core/xwiki-platform-captcha/xwiki-platform-captcha-jcaptcha/xwiki-platform-captcha-jcaptcha-api/src/test/java/org/xwiki/captcha/internal/CaptchaServiceManagerTest.java Log Message: ----------- [SECURITY] Validate CaptchaEngine type before dynamic class loading Fixes SonarQube javasecurity:S6173 (dynamic class loading with potentially user-controlled input). In CaptchaServiceManager.getCaptchaService(), the engine class name could be influenced by untrusted input flowing through captchaParameters. The fix validates that the loaded class is assignable to CaptchaEngine before instantiating it, preventing arbitrary classes from being loaded. Also replaces the deprecated getConstructor(null).newInstance(null) with getDeclaredConstructor().newInstance(). Adds a message-only constructor to CaptchaException to support the new validation error path, and adds a CaptchaServiceManagerTest covering the validation logic. https://claude.ai/code/session_0175Ge3fDXFYeRBCxDeNx5vF To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 4824d0: XWIKI-24352: Bad escaping in WikiManager pages
by XWiki Notifications 20 May '26

20 May '26

Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-platform Commit: 4824d00a3ea0c1437b3739b3b349ddc977f641cc https://github.com/xwiki/xwiki-platform/commit/4824d00a3ea0c1437b3739b3b349… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-05-20 (Wed, 20 May 2026) Changed paths: M xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml M xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/WikiActivityServiceCode.xml Log Message: ----------- XWIKI-24352: Bad escaping in WikiManager pages (cherry picked from commit 81dc4e862381e088a4d7744442d7a17c1de7e90e) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0