Code injection in template provider administration in xwiki-platform

@@ -25,6 +25,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Order;
 import org.junit.jupiter.api.Test;
+import org.openqa.selenium.WebElement;
 import org.xwiki.administration.test.po.TemplateProviderInlinePage;
 import org.xwiki.administration.test.po.TemplatesAdministrationSectionPage;
 import org.xwiki.model.reference.DocumentReference;
@@ -358,6 +359,29 @@ void createPageFromForbiddenTemplate(TestUtils setup, TestReference testReferenc
         assertEquals("Some content in that page", viewPage.getContent());
     }
 
+    /**
+     * The goal of this test is to check that the template provider's title is correctly escaped.
+     */
+    @Test
+    @Order(5)
+    void templateProviderTitleEscaping(TestUtils setup, TestReference testReference) throws Exception
+    {
+        cleanUp(setup, testReference);
+
+        // Create a template
+        String templateContent = "Templates are fun";
+        String providerName = "{{html}}<span>HTML</span>{{/html}}";
+        LocalDocumentReference templateProviderReference = new LocalDocumentReference(providerName,
+            testReference.getLocalDocumentReference().getParent());
+        createTemplateAndTemplateProvider(setup, templateProviderReference, templateContent,
+            "Funny templates", true);
+
+        TemplatesAdministrationSectionPage adminPage = TemplatesAdministrationSectionPage.gotoPage();
+        List<WebElement> links = adminPage.getExistingTemplatesLinks();
+        assertFalse(links.stream().anyMatch(element -> element.getText().equals("HTML")));
+        assertTrue(links.stream().anyMatch(element -> providerName.equals(element.getText())));
+    }
+
     /**
      * Helper function to Create both a Template and a Template Provider for the tests in this class.
      */

@@ -112,7 +112,7 @@
   == {{translation key="admin.templates.providerslist"/}} ==
 
     #foreach($providerFullname in $availableProviders)
-      * [[$services.rendering.escape($xwiki.getDocument($providerFullname).plainTitle, $xwiki.currentContentSyntaxId)>>$providerFullname]]
+      * [[$services.rendering.escape($services.rendering.escape($xwiki.getDocument($providerFullname).plainTitle, $xwiki.currentContentSyntaxId), $xwiki.currentContentSyntaxId)>>$services.rendering.escape($providerFullname, $xwiki.currentContentSyntaxId)]]
     #end
   )))
 #end