Code injection from view right using Invitation.InvitationCommon in xwiki-platform

@@ -44,5 +44,38 @@
       <type>xar</type>
       <scope>runtime</scope>
     </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
+      <version>${project.version}</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-user-default</artifactId>
+      <version>${project.version}</version>
+      <scope>runtime</scope>
+    </dependency>
+    <!-- Test dependencies. -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-test-page</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
+      <version>${project.version}</version>
+      <type>test-jar</type>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-user-default</artifactId>
+      <version>${project.version}</version>
+      <type>test-jar</type>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 </project>

@@ -20,7 +20,7 @@
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 -->
 
-<xwikidoc version="1.3" reference="Invitation.InvitationCommon" locale="">
+<xwikidoc version="1.4" reference="Invitation.InvitationCommon" locale="">
   <web>Invitation</web>
   <name>InvitationCommon</name>
   <language/>
@@ -34,7 +34,7 @@
   <title/>
   <comment/>
   <minorEdit>false</minorEdit>
-  <syntaxId>xwiki/2.0</syntaxId>
+  <syntaxId>xwiki/2.1</syntaxId>
   <hidden>true</hidden>
   <content>{{velocity}}
 #*
@@ -80,7 +80,7 @@
 
   {{html wiki=false clean=false}}
   &lt;div id="invitation-displaymessage" class="invitation"&gt;
-   &lt;strong&gt;$services.localization.render('xe.invitation.previewLabel')&lt;/strong&gt;
+   &lt;strong&gt;$escapetool.xml($services.localization.render('xe.invitation.previewLabel'))&lt;/strong&gt;
    &lt;div class="invitation invitation-preview"&gt;
     #set($recips = [])
     #set($invalid = [])
@@ -99,7 +99,7 @@
     #end
     ## Print the email addresses to be sent to.
     ## To:
-    &lt;strong&gt;$services.localization.render('xe.invitation.toLabel')&lt;/strong&gt;
+    &lt;strong&gt;$escapetool.xml($services.localization.render('xe.invitation.toLabel'))&lt;/strong&gt;
     &lt;div id="preview-to-field" class="invitation-preview field"&gt;
      #foreach($recip in $recips)
        #if($invalid.contains($recip))
@@ -120,24 +120,24 @@
        &lt;span class="errormessage"&gt;
         #if($recips.size() == 1)
           ## The email address given is invalid and will not be sent to.
-          $services.localization.render('xe.invitation.displayMessage.theAddressIsInvalid')
+          $escapetool.xml($services.localization.render('xe.invitation.displayMessage.theAddressIsInvalid'))
         #else
           #if($invalid.size() &gt; 1)
-            $services.localization.render('xe.invitation.displayMessage.someAddressesAreInvalid', [$invalidAddresses.size()])
+            $escapetool.xml($services.localization.render('xe.invitation.displayMessage.someAddressesAreInvalid', [$invalidAddresses.size()]))
           #else
-            $services.localization.render('xe.invitation.displayMessage.anAddressesIsInvalid')
+            $escapetool.xml($services.localization.render('xe.invitation.displayMessage.anAddressesIsInvalid'))
           #end
         #end
        &lt;/span&gt;
       &lt;/p&gt;
     #end
      ## Subject:
-     &lt;strong&gt;$services.localization.render('xe.invitation.subjectLabel')&lt;/strong&gt;
+     &lt;strong&gt;$escapetool.xml($services.localization.render('xe.invitation.subjectLabel'))&lt;/strong&gt;
     &lt;div id="preview-subjectline-field" class="invitation-preview field"&gt;
      $escapetool.xml($mail.getProperty('subjectLine').getValue())
     &lt;/div&gt;
     ## Message:
-    &lt;strong&gt;$services.localization.render('xe.invitation.contentLabel')&lt;/strong&gt;
+    &lt;strong&gt;$escapetool.xml($services.localization.render('xe.invitation.contentLabel'))&lt;/strong&gt;
     &lt;div id="preview-messagebody-field" class="invitation-preview field"&gt;
      $mail.getProperty('messageBody').getValue()
     &lt;/div&gt;
@@ -232,7 +232,8 @@
   #end
   #set($configClass = $xwiki.getDocumentAsAuthor("${doc.getSpace()}.WebHome"))
   #if($configClass.isNew())
-    {{error}}Class document [[${doc.getSpace()}.WebHome]] not found. can't run test.{{/error}}
+    #set ($classDocumentLink = $services.rendering.escape("${doc.getSpace()}.WebHome", 'xwiki/2.1'))
+    {{error}}Class document [[$classDocumentLink]] not found. can't run test.{{/error}}
   #else
     #set($config = {})
     #loadInvitationConfig($config, 'HopefullyNonexistantSpace')
@@ -496,10 +497,10 @@
         <number>5</number>
         <picker>1</picker>
         <prettyName>Email message XClass</prettyName>
-        <size>30</size>
         <relationalStorage>0</relationalStorage>
         <separator> </separator>
         <separators/>
+        <size>30</size>
         <sort>none</sort>
         <sql/>
         <unmodifiable>0</unmodifiable>
@@ -521,10 +522,10 @@
         <number>9</number>
         <picker>1</picker>
         <prettyName>Document containing email XObjects</prettyName>
-        <size>30</size>
         <relationalStorage>0</relationalStorage>
         <separator> </separator>
         <separators/>
+        <size>30</size>
         <sort>none</sort>
         <sql/>
         <unmodifiable>0</unmodifiable>
@@ -843,11 +844,14 @@ $services.localization.render('xe.invitation.emailContent.reportMessage', ["&lt;
       <validationScript/>
       <cache>
         <cache>0</cache>
+        <defaultValue>long</defaultValue>
         <disabled>0</disabled>
         <displayType>select</displayType>
+        <freeText>forbidden</freeText>
+        <largeStorage>0</largeStorage>
         <multiSelect>0</multiSelect>
         <name>cache</name>
-        <number>6</number>
+        <number>5</number>
         <prettyName>Caching policy</prettyName>
         <relationalStorage>0</relationalStorage>
         <separator> </separator>
@@ -858,9 +862,11 @@ $services.localization.render('xe.invitation.emailContent.reportMessage', ["&lt;
         <classType>com.xpn.xwiki.objects.classes.StaticListClass</classType>
       </cache>
       <code>
+        <contenttype>PureText</contenttype>
         <disabled>0</disabled>
+        <editor>PureText</editor>
         <name>code</name>
-        <number>3</number>
+        <number>2</number>
         <prettyName>Code</prettyName>
         <rows>20</rows>
         <size>50</size>
@@ -871,9 +877,11 @@ $services.localization.render('xe.invitation.emailContent.reportMessage', ["&lt;
         <cache>0</cache>
         <disabled>0</disabled>
         <displayType>select</displayType>
+        <freeText>forbidden</freeText>
+        <largeStorage>0</largeStorage>
         <multiSelect>0</multiSelect>
         <name>contentType</name>
-        <number>1</number>
+        <number>6</number>
         <prettyName>Content Type</prettyName>
         <relationalStorage>0</relationalStorage>
         <separator> </separator>
@@ -886,7 +894,7 @@ $services.localization.render('xe.invitation.emailContent.reportMessage', ["&lt;
       <name>
         <disabled>0</disabled>
         <name>name</name>
-        <number>2</number>
+        <number>1</number>
         <prettyName>Name</prettyName>
         <size>30</size>
         <unmodifiable>0</unmodifiable>
@@ -897,7 +905,7 @@ $services.localization.render('xe.invitation.emailContent.reportMessage', ["&lt;
         <displayFormType>select</displayFormType>
         <displayType>yesno</displayType>
         <name>parse</name>
-        <number>5</number>
+        <number>4</number>
         <prettyName>Parse content</prettyName>
         <unmodifiable>0</unmodifiable>
         <classType>com.xpn.xwiki.objects.classes.BooleanClass</classType>
@@ -906,9 +914,11 @@ $services.localization.render('xe.invitation.emailContent.reportMessage', ["&lt;
         <cache>0</cache>
         <disabled>0</disabled>
         <displayType>select</displayType>
+        <freeText>forbidden</freeText>
+        <largeStorage>0</largeStorage>
         <multiSelect>0</multiSelect>
         <name>use</name>
-        <number>4</number>
+        <number>3</number>
         <prettyName>Use this extension</prettyName>
         <relationalStorage>0</relationalStorage>
         <separator> </separator>

@@ -0,0 +1,269 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.invitation;
+
+import java.util.stream.IntStream;
+
+import javax.script.ScriptContext;
+
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.jsoup.nodes.Element;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xwiki.model.reference.DocumentReference;
+import org.xwiki.rendering.RenderingScriptServiceComponentList;
+import org.xwiki.rendering.internal.configuration.DefaultExtendedRenderingConfiguration;
+import org.xwiki.rendering.internal.configuration.RenderingConfigClassDocumentConfigurationSource;
+import org.xwiki.rendering.internal.macro.message.ErrorMessageMacro;
+import org.xwiki.rendering.internal.macro.message.InfoMessageMacro;
+import org.xwiki.rendering.syntax.Syntax;
+import org.xwiki.script.ScriptContextManager;
+import org.xwiki.security.authorization.AuthorizationManager;
+import org.xwiki.test.annotation.ComponentList;
+import org.xwiki.test.page.HTML50ComponentList;
+import org.xwiki.test.page.PageTest;
+import org.xwiki.test.page.TestNoScriptMacro;
+import org.xwiki.test.page.XWikiSyntax21ComponentList;
+import org.xwiki.user.UserReferenceComponentList;
+
+import com.xpn.xwiki.api.Object;
+import com.xpn.xwiki.doc.XWikiDocument;
+import com.xpn.xwiki.objects.BaseObject;
+
+import static javax.script.ScriptContext.GLOBAL_SCOPE;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.when;
+
+/**
+ * Test of {@code Invitation.InvitationCommon}.
+ *
+ * @version $Id$
+ * @since 15.0RC1
+ * @since 14.10.1
+ * @since 14.4.8
+ * @since 13.10.11
+ */
+@HTML50ComponentList
+@XWikiSyntax21ComponentList
+@RenderingScriptServiceComponentList
+@UserReferenceComponentList
+@ComponentList({
+    InfoMessageMacro.class,
+    ErrorMessageMacro.class,
+    // Start - Required in addition of RenderingScriptServiceComponentList
+    DefaultExtendedRenderingConfiguration.class,
+    RenderingConfigClassDocumentConfigurationSource.class,
+    // End - Required in additional of RenderingScriptServiceComponentList
+    TestNoScriptMacro.class
+})
+class InvitationCommonPageTest extends PageTest
+{
+    private ScriptContext scriptContext;
+
+    @BeforeEach
+    void setUp() throws Exception
+    {
+        AuthorizationManager authorizationManager = this.componentManager.getInstance(AuthorizationManager.class);
+        // Allow everything by default.
+        when(authorizationManager.hasAccess(any(), any(), any())).thenReturn(true);
+        this.scriptContext = this.oldcore.getMocker().<ScriptContextManager>getInstance(ScriptContextManager.class)
+            .getCurrentScriptContext();
+    }
+
+    @Test
+    void testEq0() throws Exception
+    {
+        this.context.setDoc(this.xwiki.getDocument(
+            new DocumentReference("xwiki", "<script>console.log</script>", "InvitationCommon"), this.context));
+
+        DocumentReference invitationCommonReference = new DocumentReference("xwiki", "Invitation", "InvitationCommon");
+        Document document = Jsoup.parse(loadPage(invitationCommonReference).getRenderedContent(this.context));
+        assertEquals("xe.invitation.internalDocument [<script>console\\.log</script>.WebHome]",
+            document.selectFirst(".infomessage").text());
+    }
+
+    @Test
+    void testEq1ConfigClassIsNew() throws Exception
+    {
+        String spaceName = "<script>console.log</script>]]{{noscript/}}";
+        DocumentReference invitationCommonReference = new DocumentReference("xwiki", "Invitation", "InvitationCommon");
+
+        XWikiDocument doc =
+            this.xwiki.getDocument(new DocumentReference("xwiki", spaceName, "InvitationCommon"), this.context);
+        this.xwiki.saveDocument(doc, this.context);
+        this.context.setDoc(doc);
+
+        this.request.put("test", "1");
+
+        Document document = Jsoup.parse(loadPage(invitationCommonReference).getRenderedContent(this.context));
+
+        assertEquals("testLoadInvitationConfig", document.selectFirst(".infomessage").text());
+        Element errorMessage = document.selectFirst(".errormessage");
+        assertEquals("Class document <script>console\\.log</script>]]{{noscript/}}.WebHome not found. "
+            + "can't run test.", errorMessage.text());
+        Element errorLink = errorMessage.selectFirst("a");
+        assertEquals("<script>console\\.log</script>]]{{noscript/}}.WebHome", errorLink.text());
+        assertEquals("<script>console\\.log</script>]]{{noscript/}}.WebHome", errorLink.attr("href"));
+    }
+
+    @Test
+    void testEq1ConfigClassExistsInvalidFromAddress() throws Exception
+    {
+        // Create an InvitationCommon file.
+        DocumentReference documentReference =
+            new DocumentReference("xwiki", "<script>console.log</script>", "InvitationCommon");
+        XWikiDocument doc = this.xwiki.getDocument(documentReference, this.context);
+        this.xwiki.saveDocument(doc, this.context);
+        this.context.setDoc(doc);
+
+        // Create a WebHome file in the same space as InvitationCommon, with an XClass containing the expected fields.
+        DocumentReference configDocumentReference =
+            new DocumentReference("xwiki", "<script>console.log</script>", "WebHome");
+        XWikiDocument configDoc = this.xwiki.getDocument(configDocumentReference, this.context);
+        configDoc.getXClass().addTextField("from_address", "From Address", 30);
+        this.xwiki.saveDocument(configDoc, this.context);
+
+        // Initialize the document in the same space as InvitationCommon, containing an XObject with a WebHome XObject.
+        XWikiDocument hopefullyNonExistantSpaceDoc = this.xwiki.getDocument(
+            new DocumentReference("xwiki", "<script>console.log</script>", "HopefullyNonexistantSpace"), this.context);
+        BaseObject invitationConfigXObject =
+            hopefullyNonExistantSpaceDoc.newXObject(configDocumentReference, this.context);
+        invitationConfigXObject.set("from_address", "<script>console.log('from_address')</script>", this.context);
+        this.xwiki.saveDocument(hopefullyNonExistantSpaceDoc, this.context);
+
+        this.request.put("test", "1");
+
+        XWikiDocument invitationCommonDoc = loadPage(new DocumentReference("xwiki", "Invitation", "InvitationCommon"));
+        Document document = Jsoup.parse(invitationCommonDoc.getRenderedContent(this.context));
+
+        assertEquals("testLoadInvitationConfig", document.selectFirst(".infomessage").text());
+        Element firstErrorMessage = document.selectFirst(".errormessage");
+        assertEquals("Config map too small", firstErrorMessage.text());
+        Element secondErrorMessage = document.select(".errormessage").get(1);
+        assertEquals("form_address incorrect, expecting \"no-reply@localhost.localdomain\" "
+            + "got \"<script>console.log('from_address')</script>\"", secondErrorMessage.text());
+    }
+
+    @Test
+    void testEq1ConfigClassExistsConfigMapTooSmall() throws Exception
+    {
+        // Create an InvitationCommon file.
+        XWikiDocument doc = this.xwiki
+            .getDocument(new DocumentReference("xwiki", "<script>console.log</script>", "InvitationCommon"),
+                this.context);
+        this.xwiki.saveDocument(doc, this.context);
+        this.context.setDoc(doc);
+
+        // Create a WebHome file in the same space as InvitationCommon, with an XClass containing the expected fields.
+        DocumentReference configDocumentReference =
+            new DocumentReference("xwiki", "<script>console.log</script>", "WebHome");
+        XWikiDocument configDoc = this.xwiki.getDocument(configDocumentReference, this.context);
+        configDoc.getXClass().addTextField("from_address", "From Address", 30);
+
+        this.xwiki.saveDocument(configDoc, this.context);
+
+        // Initialize the document in the same space as InvitationCommon, containing an XObject with a WebHome XObject.
+        XWikiDocument hopefullyNonExistantSpaceDoc = this.xwiki.getDocument(
+            new DocumentReference("xwiki", "<script>console.log</script>", "HopefullyNonexistantSpace"), this.context);
+        BaseObject invitationConfigXObject =
+            hopefullyNonExistantSpaceDoc.newXObject(configDocumentReference, this.context);
+        invitationConfigXObject.set("from_address", "no-reply@localhost.localdomain", this.context);
+        this.xwiki.saveDocument(hopefullyNonExistantSpaceDoc, this.context);
+
+        this.request.put("test", "1");
+
+        DocumentReference reference = new DocumentReference("xwiki", "Invitation", "InvitationCommon");
+        XWikiDocument invitationCommonDoc = loadPage(reference);
+        Document document = Jsoup.parse(invitationCommonDoc.getRenderedContent(this.context));
+
+        assertEquals("testLoadInvitationConfig", document.selectFirst(".infomessage").text());
+        Element firstErrorMessage = document.selectFirst(".errormessage");
+        assertEquals("Config map too small", firstErrorMessage.text());
+        Element secondErrorMessage = document.select(".errormessage").get(1);
+        assertEquals("Config document not created", secondErrorMessage.text());
+    }
+
+    @Test
+    void testEq1ConfigClassExistsNewInvitationConfig() throws Exception
+    {
+        // Create an InvitationCommon file.
+        XWikiDocument doc = this.xwiki.getDocument(
+            new DocumentReference("xwiki", "<script>console.log</script>", "InvitationCommon"), this.context);
+        this.xwiki.saveDocument(doc, this.context);
+        this.context.setDoc(doc);
+
+        // Create a WebHome file in the same space as InvitationCommon, with an XClass containing the expected fields.
+        DocumentReference configDocumentReference =
+            new DocumentReference("xwiki", "<script>console.log</script>", "WebHome");
+        XWikiDocument configDoc = this.xwiki.getDocument(configDocumentReference, this.context);
+        configDoc.getXClass().addTextField("from_address", "From Address", 30);
+        // Initialize 8 fields, because that's the only check performed in the document currently.
+        IntStream.range(0, 8)
+            .forEach(value -> configDoc.getXClass().addTextField("field" + value, "Field " + value, 30));
+        this.xwiki.saveDocument(configDoc, this.context);
+
+        // Initialize the document in the same space as InvitationCommon, containing an XObject with a WebHome XObject.
+        XWikiDocument hopefullyNonExistantSpaceDoc = this.xwiki.getDocument(
+            new DocumentReference("xwiki", "<script>console.log</script>", "HopefullyNonexistantSpace"), this.context);
+        BaseObject invitationConfigXObject =
+            hopefullyNonExistantSpaceDoc.newXObject(configDocumentReference, this.context);
+        invitationConfigXObject.set("from_address", "no-reply@localhost.localdomain", this.context);
+        IntStream.range(0, 8)
+            .forEach(value -> invitationConfigXObject.set("field" + value, "value " + value, this.context));
+        this.xwiki.saveDocument(hopefullyNonExistantSpaceDoc, this.context);
+
+        this.request.put("test", "1");
+
+        DocumentReference reference = new DocumentReference("xwiki", "Invitation", "InvitationCommon");
+        XWikiDocument invitationCommonDoc = loadPage(reference);
+        Document document = Jsoup.parse(invitationCommonDoc.getRenderedContent(this.context));
+
+        assertEquals("testLoadInvitationConfig", document.selectFirst(".infomessage").text());
+        Element firstErrorMessage = document.selectFirst(".errormessage");
+        assertEquals("Config document not created", firstErrorMessage.text());
+    }
+
+    @Test
+    void displayMessageVelocityMacro() throws Exception
+    {
+        loadPage(new DocumentReference("xwiki", "Invitation", "InvitationCommon"));
+        DocumentReference invitationMailClassDocumentReference =
+            new DocumentReference("xwiki", "Invitation", "InvitationMailClass");
+        loadPage(invitationMailClassDocumentReference);
+
+        XWikiDocument page = this.xwiki.getDocument(new DocumentReference("xwiki", "Space", "Page"), this.context);
+        BaseObject invitationMailXObject = page.newXObject(invitationMailClassDocumentReference, this.context);
+        invitationMailXObject.set("messageBody", "<strong>message body</strong>", this.context);
+        page.setSyntax(Syntax.XWIKI_2_1);
+        page.setContent("{{include reference=\"Invitation.InvitationCommon\"/}}\n"
+            + "\n"
+            + "{{velocity}}\n"
+            + "$mail.class\n"
+            + "#displayMessage($mail)\n"
+            + "{{/velocity}}");
+
+        this.scriptContext.setAttribute("mail", new Object(invitationMailXObject, this.context), GLOBAL_SCOPE);
+
+        Document document = renderHTMLPage(page);
+        assertEquals("<strong>message body</strong>", document.selectFirst("#preview-messagebody-field").html());
+    }
+}