Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: cdc18aedf88094666f1b21646aaa09693b821e9b https://github.com/xwiki/xwiki-platform/commit/cdc18aedf88094666f1b21646aaa0... Author: Michael Hamann <michael.hamann@xwiki.com> Date: 2026-03-09 (Mon, 09 Mar 2026) Changed paths: M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/XARImportIT.java A xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/resources/XARImportIT/XSSImport.xar M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/pom.xml M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/src/main/java/org/xwiki/administration/test/po/ImportAdministrationSectionPage.java M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/js/xwiki/importer/import.js Log Message: ----------- XWIKI-23755: Import package metadata is improperly escaped - Use textContent instead of Prototype.js's .update() method for displaying package metadata (package name, version, author, license, space name, document name, and attachment filename). - Add testXSSInPackageExplorer integration test that: - Uploads a XAR with HTML payloads in all displayed fields using a filename that itself contains HTML - Asserts each field is displayed as literal text (positive assertions) - Asserts no injected DOM elements with xss-* IDs exist (negative) - Adds XSSImport.xar test resource with unique HTML payloads per field Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications