VYPR
Critical severityNVD Advisory· Published Apr 10, 2024· Updated Aug 13, 2024

XWiki Platform: Remote code execution through space title and Solr space facet

CVE-2024-31984

Description

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the Main.SolrSpaceFacet page.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-search-solr-uiMaven
>= 7.2-rc-1, < 14.10.2014.10.20
org.xwiki.platform:xwiki-platform-search-solr-uiMaven
>= 15.0-rc-1, < 15.5.415.5.4
org.xwiki.platform:xwiki-platform-search-solr-uiMaven
>= 15.6-rc-1, < 15.10-rc-115.10-rc-1

Affected products

1

Patches

6
5ef9d294d37b

XWIKI-21471: Improve Maven profile filtering

https://github.com/xwiki/xwiki-platformpjeanjeanNov 9, 2023via ghsa
1 file changed · +1 6
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml+1 6 modified
    @@ -39,14 +39,9 @@
       </properties>
       <modules>
         <module>xwiki-platform-search-solr-test-pageobjects</module>
    +    <module>xwiki-platform-search-solr-test-utils</module>
       </modules>
       <profiles>
    -    <profile>
    -      <id>integration-tests</id>
    -      <modules>
    -        <module>xwiki-platform-search-solr-test-utils</module>
    -      </modules>
    -    </profile>
         <profile>
           <id>docker</id>
           <modules>
    
ef55105d6eee

XWIKI-21471: Improve Maven profile filtering

https://github.com/xwiki/xwiki-platformpjeanjeanNov 9, 2023via ghsa
1 file changed · +1 6
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml+1 6 modified
    @@ -39,14 +39,9 @@
       </properties>
       <modules>
         <module>xwiki-platform-search-solr-test-pageobjects</module>
    +    <module>xwiki-platform-search-solr-test-utils</module>
       </modules>
       <profiles>
    -    <profile>
    -      <id>integration-tests</id>
    -      <modules>
    -        <module>xwiki-platform-search-solr-test-utils</module>
    -      </modules>
    -    </profile>
         <profile>
           <id>docker</id>
           <modules>
    
74e301c481e6

XWIKI-21471: Improve Maven profile filtering

https://github.com/xwiki/xwiki-platformpjeanjeanNov 9, 2023via ghsa
1 file changed · +1 6
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml+1 6 modified
    @@ -39,14 +39,9 @@
       </properties>
       <modules>
         <module>xwiki-platform-search-solr-test-pageobjects</module>
    +    <module>xwiki-platform-search-solr-test-utils</module>
       </modules>
       <profiles>
    -    <profile>
    -      <id>integration-tests</id>
    -      <modules>
    -        <module>xwiki-platform-search-solr-test-utils</module>
    -      </modules>
    -    </profile>
         <profile>
           <id>docker</id>
           <modules>
    
43c9d551e3c1

XWIKI-21471: Improve escaping in Solr Space Faucet

https://github.com/xwiki/xwiki-platformpjeanjeanNov 2, 2023via ghsa
10 files changed · +366 4
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml+1 1 modified
    @@ -119,7 +119,7 @@
         <profile>
           <id>integration-tests</id>
           <modules>
    -        <module>xwiki-platform-search-solr-test-utils</module>
    +        <module>xwiki-platform-search-solr-test</module>
           </modules>
         </profile>
       </profiles>
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml+57 0 added
    @@ -0,0 +1,57 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr</artifactId>
    +    <version>15.5.4-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Parent POM</name>
    +  <packaging>pom</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Parent POM</description>
    +  <properties>
    +    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
    +    <xwiki.revapi.skip>true</xwiki.revapi.skip>
    +    <!-- Don't run Checkstyle in test modules -->
    +    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
    +  </properties>
    +  <modules>
    +    <module>xwiki-platform-search-solr-test-pageobjects</module>
    +  </modules>
    +  <profiles>
    +    <profile>
    +      <id>integration-tests</id>
    +      <modules>
    +        <module>xwiki-platform-search-solr-test-utils</module>
    +      </modules>
    +    </profile>
    +    <profile>
    +      <id>docker</id>
    +      <modules>
    +        <module>xwiki-platform-search-solr-test-docker</module>
    +      </modules>
    +    </profile>
    +  </profiles>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml+102 0 added
    @@ -0,0 +1,102 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
    +    <version>15.5.4-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test-docker</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Functional Docker Tests</name>
    +  <packaging>jar</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Functional Tests in Docker</description>
    +  <properties>
    +    <!-- Functional tests are allowed to output content to the console -->
    +    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
    +  </properties>
    +  <dependencies>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-ui</artifactId>
    +      <version>${project.version}</version>
    +      <type>xar</type>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-test-docker</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +  </dependencies>
    +  <build>
    +    <testSourceDirectory>src/test/it</testSourceDirectory>
    +    <plugins>
    +      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
    +      <plugin>
    +        <groupId>org.apache.maven.plugins</groupId>
    +        <artifactId>maven-failsafe-plugin</artifactId>
    +      </plugin>
    +    </plugins>
    +  </build>
    +  <profiles>
    +    <profile>
    +      <id>clover</id>
    +      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
    +           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
    +      <dependencies>
    +        <dependency>
    +          <groupId>org.openclover</groupId>
    +          <artifactId>clover</artifactId>
    +        </dependency>
    +      </dependencies>
    +      <build>
    +        <plugins>
    +          <plugin>
    +            <groupId>org.apache.maven.plugins</groupId>
    +            <artifactId>maven-failsafe-plugin</artifactId>
    +            <configuration>
    +              <systemPropertyVariables>
    +                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
    +                     WEB-INF/lib -->
    +                <xwiki.test.ui.profiles>clover</xwiki.test.ui.profiles>
    +              </systemPropertyVariables>
    +            </configuration>
    +          </plugin>
    +        </plugins>
    +      </build>
    +    </profile>
    +  </profiles>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java+37 0 added
    @@ -0,0 +1,37 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.ui;
    +
    +import org.junit.jupiter.api.Nested;
    +import org.xwiki.test.docker.junit5.UITest;
    +
    +/**
    + * All UI tests for the Solr Search feature.
    + *
    + * @version $Id$
    + */
    +@UITest
    +class AllIT
    +{
    +    @Nested
    +    class NestedSolrSearchIT extends SolrSearchIT
    +    {
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java+62 0 added
    @@ -0,0 +1,62 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.ui;
    +
    +import org.junit.jupiter.api.Test;
    +import org.xwiki.repository.test.SolrTestUtils;
    +import org.xwiki.search.solr.test.po.SolrSearchPage;
    +import org.xwiki.test.docker.junit5.TestConfiguration;
    +import org.xwiki.test.docker.junit5.UITest;
    +import org.xwiki.test.docker.junit5.servletengine.ServletEngine;
    +import org.xwiki.test.integration.XWikiExecutor;
    +import org.xwiki.test.ui.TestUtils;
    +
    +import static org.junit.jupiter.api.Assertions.assertEquals;
    +
    +/**
    + * Tests Solr search features.
    + *
    + * @version $Id$
    + */
    +@UITest
    +class SolrSearchIT
    +{
    +    @Test
    +    void verifySpaceFaucetEscaping(TestUtils setup, TestConfiguration testConfiguration) throws Exception {
    +        setup.loginAsSuperAdmin();
    +
    +        String testDocumentLocation = "{{/html}}";
    +        setup.createPage(testDocumentLocation, "WebHome", "Test Document", testDocumentLocation);
    +
    +        new SolrTestUtils(setup, computedHostURL(testConfiguration)).waitEmptyQueue();
    +
    +        SolrSearchPage searchPage = SolrSearchPage.gotoPage();
    +        searchPage.search("\"Test Document\"");
    +        searchPage.toggleSpaceFaucet();
    +        assertEquals(testDocumentLocation + "\n1", searchPage.getSpaceFaucetContent());
    +    }
    +
    +    private String computedHostURL(TestConfiguration testConfiguration)
    +    {
    +        ServletEngine servletEngine = testConfiguration.getServletEngine();
    +        return String.format("http://%s:%d%s", servletEngine.getIP(), servletEngine.getPort(),
    +            XWikiExecutor.DEFAULT_CONTEXT);
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml+45 0 added
    @@ -0,0 +1,45 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
    +    <version>15.5.4-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Page Objects</name>
    +  <packaging>jar</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Page Objects</description>
    +  <properties>
    +    <!-- None of the classes is valid -->
    +    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
    +  </properties>
    +  <dependencies>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-test-ui</artifactId>
    +      <version>${project.version}</version>
    +    </dependency>
    +  </dependencies>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java+59 0 added
    @@ -0,0 +1,59 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.po;
    +
    +import org.openqa.selenium.WebElement;
    +import org.openqa.selenium.support.FindBy;
    +import org.xwiki.test.ui.po.ViewPage;
    +
    +public class SolrSearchPage extends ViewPage
    +{
    +    @FindBy(id = "search-page-bar-input")
    +    private WebElement searchInput;
    +
    +    @FindBy(xpath = "//div[@class = 'search-ui']//button[@type = 'submit']")
    +    private WebElement searchButton;
    +
    +    @FindBy(xpath = "//div[@class = 'search-ui']//button[@aria-controls = 'space_facet-dropdown']")
    +    private WebElement spaceFaucetDropdownButton;
    +
    +    @FindBy(xpath = "//div[@id = 'space_facet-dropdown']")
    +    private WebElement spaceFaucetDropdownContent;
    +
    +    public static SolrSearchPage gotoPage()
    +    {
    +        getUtil().gotoPage("Main", "SolrSearch", "view");
    +        return new SolrSearchPage();
    +    }
    +
    +    public void search(String terms) {
    +        this.searchInput.clear();
    +        this.searchInput.sendKeys(terms);
    +        this.searchButton.click();
    +    }
    +
    +    public void toggleSpaceFaucet() {
    +        this.spaceFaucetDropdownButton.click();
    +    }
    +
    +    public String getSpaceFaucetContent() {
    +        return this.spaceFaucetDropdownContent.getText();
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml+1 1 renamed
    @@ -24,7 +24,7 @@
       <modelVersion>4.0.0</modelVersion>
       <parent>
         <groupId>org.xwiki.platform</groupId>
    -    <artifactId>xwiki-platform-search-solr</artifactId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
         <version>15.5.4-SNAPSHOT</version>
       </parent>
       <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java+0 0 renamed
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml+2 2 modified
    @@ -42,9 +42,9 @@
       #set ($spaceReference = $services.model.resolveSpace($localSpaceReference))
       #set ($spaceDocument = $xwiki.getDocument($spaceReference))
       #if ($spaceDocument)
    -    $spaceDocument.plainTitle
    +    $escapetool.xml($spaceDocument.plainTitle)
       #else
    -    $spaceReference.name
    +    $escapetool.xml($spaceReference.name)
       #end
     #end
     #macro (getSpaceFacetHierarchyPathData $spaceReference $return $options)
    
94fc12db87c2

XWIKI-21471: Improve escaping in Solr Space Faucet

https://github.com/xwiki/xwiki-platformpjeanjeanNov 2, 2023via ghsa
10 files changed · +366 4
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml+1 1 modified
    @@ -119,7 +119,7 @@
         <profile>
           <id>integration-tests</id>
           <modules>
    -        <module>xwiki-platform-search-solr-test-utils</module>
    +        <module>xwiki-platform-search-solr-test</module>
           </modules>
         </profile>
       </profiles>
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml+57 0 added
    @@ -0,0 +1,57 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr</artifactId>
    +    <version>14.10.20-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Parent POM</name>
    +  <packaging>pom</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Parent POM</description>
    +  <properties>
    +    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
    +    <xwiki.revapi.skip>true</xwiki.revapi.skip>
    +    <!-- Don't run Checkstyle in test modules -->
    +    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
    +  </properties>
    +  <modules>
    +    <module>xwiki-platform-search-solr-test-pageobjects</module>
    +  </modules>
    +  <profiles>
    +    <profile>
    +      <id>integration-tests</id>
    +      <modules>
    +        <module>xwiki-platform-search-solr-test-utils</module>
    +      </modules>
    +    </profile>
    +    <profile>
    +      <id>docker</id>
    +      <modules>
    +        <module>xwiki-platform-search-solr-test-docker</module>
    +      </modules>
    +    </profile>
    +  </profiles>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml+102 0 added
    @@ -0,0 +1,102 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
    +    <version>14.10.20-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test-docker</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Functional Docker Tests</name>
    +  <packaging>jar</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Functional Tests in Docker</description>
    +  <properties>
    +    <!-- Functional tests are allowed to output content to the console -->
    +    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
    +  </properties>
    +  <dependencies>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-ui</artifactId>
    +      <version>${project.version}</version>
    +      <type>xar</type>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-test-docker</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +  </dependencies>
    +  <build>
    +    <testSourceDirectory>src/test/it</testSourceDirectory>
    +    <plugins>
    +      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
    +      <plugin>
    +        <groupId>org.apache.maven.plugins</groupId>
    +        <artifactId>maven-failsafe-plugin</artifactId>
    +      </plugin>
    +    </plugins>
    +  </build>
    +  <profiles>
    +    <profile>
    +      <id>clover</id>
    +      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
    +           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
    +      <dependencies>
    +        <dependency>
    +          <groupId>org.openclover</groupId>
    +          <artifactId>clover</artifactId>
    +        </dependency>
    +      </dependencies>
    +      <build>
    +        <plugins>
    +          <plugin>
    +            <groupId>org.apache.maven.plugins</groupId>
    +            <artifactId>maven-failsafe-plugin</artifactId>
    +            <configuration>
    +              <systemPropertyVariables>
    +                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
    +                     WEB-INF/lib -->
    +                <xwiki.test.ui.profiles>clover</xwiki.test.ui.profiles>
    +              </systemPropertyVariables>
    +            </configuration>
    +          </plugin>
    +        </plugins>
    +      </build>
    +    </profile>
    +  </profiles>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java+37 0 added
    @@ -0,0 +1,37 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.ui;
    +
    +import org.junit.jupiter.api.Nested;
    +import org.xwiki.test.docker.junit5.UITest;
    +
    +/**
    + * All UI tests for the Solr Search feature.
    + *
    + * @version $Id$
    + */
    +@UITest
    +class AllIT
    +{
    +    @Nested
    +    class NestedSolrSearchIT extends SolrSearchIT
    +    {
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java+62 0 added
    @@ -0,0 +1,62 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.ui;
    +
    +import org.junit.jupiter.api.Test;
    +import org.xwiki.repository.test.SolrTestUtils;
    +import org.xwiki.search.solr.test.po.SolrSearchPage;
    +import org.xwiki.test.docker.junit5.TestConfiguration;
    +import org.xwiki.test.docker.junit5.UITest;
    +import org.xwiki.test.docker.junit5.servletengine.ServletEngine;
    +import org.xwiki.test.integration.XWikiExecutor;
    +import org.xwiki.test.ui.TestUtils;
    +
    +import static org.junit.jupiter.api.Assertions.assertEquals;
    +
    +/**
    + * Tests Solr search features.
    + *
    + * @version $Id$
    + */
    +@UITest
    +class SolrSearchIT
    +{
    +    @Test
    +    void verifySpaceFaucetEscaping(TestUtils setup, TestConfiguration testConfiguration) throws Exception {
    +        setup.loginAsSuperAdmin();
    +
    +        String testDocumentLocation = "{{/html}}";
    +        setup.createPage(testDocumentLocation, "WebHome", "Test Document", testDocumentLocation);
    +
    +        new SolrTestUtils(setup, computedHostURL(testConfiguration)).waitEmptyQueue();
    +
    +        SolrSearchPage searchPage = SolrSearchPage.gotoPage();
    +        searchPage.search("\"Test Document\"");
    +        searchPage.toggleSpaceFaucet();
    +        assertEquals(testDocumentLocation + "\n1", searchPage.getSpaceFaucetContent());
    +    }
    +
    +    private String computedHostURL(TestConfiguration testConfiguration)
    +    {
    +        ServletEngine servletEngine = testConfiguration.getServletEngine();
    +        return String.format("http://%s:%d%s", servletEngine.getIP(), servletEngine.getPort(),
    +            XWikiExecutor.DEFAULT_CONTEXT);
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml+45 0 added
    @@ -0,0 +1,45 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
    +    <version>14.10.20-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Page Objects</name>
    +  <packaging>jar</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Page Objects</description>
    +  <properties>
    +    <!-- None of the classes is valid -->
    +    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
    +  </properties>
    +  <dependencies>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-test-ui</artifactId>
    +      <version>${project.version}</version>
    +    </dependency>
    +  </dependencies>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java+59 0 added
    @@ -0,0 +1,59 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.po;
    +
    +import org.openqa.selenium.WebElement;
    +import org.openqa.selenium.support.FindBy;
    +import org.xwiki.test.ui.po.ViewPage;
    +
    +public class SolrSearchPage extends ViewPage
    +{
    +    @FindBy(id = "search-page-bar-input")
    +    private WebElement searchInput;
    +
    +    @FindBy(xpath = "//div[@class = 'search-ui']//button[@type = 'submit']")
    +    private WebElement searchButton;
    +
    +    @FindBy(xpath = "//div[@class = 'search-ui']//button[@aria-controls = 'space_facet-dropdown']")
    +    private WebElement spaceFaucetDropdownButton;
    +
    +    @FindBy(xpath = "//div[@id = 'space_facet-dropdown']")
    +    private WebElement spaceFaucetDropdownContent;
    +
    +    public static SolrSearchPage gotoPage()
    +    {
    +        getUtil().gotoPage("Main", "SolrSearch", "view");
    +        return new SolrSearchPage();
    +    }
    +
    +    public void search(String terms) {
    +        this.searchInput.clear();
    +        this.searchInput.sendKeys(terms);
    +        this.searchButton.click();
    +    }
    +
    +    public void toggleSpaceFaucet() {
    +        this.spaceFaucetDropdownButton.click();
    +    }
    +
    +    public String getSpaceFaucetContent() {
    +        return this.spaceFaucetDropdownContent.getText();
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml+1 1 renamed
    @@ -24,7 +24,7 @@
       <modelVersion>4.0.0</modelVersion>
       <parent>
         <groupId>org.xwiki.platform</groupId>
    -    <artifactId>xwiki-platform-search-solr</artifactId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
         <version>14.10.20-SNAPSHOT</version>
       </parent>
       <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java+0 0 renamed
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml+2 2 modified
    @@ -42,9 +42,9 @@
       #set ($spaceReference = $services.model.resolveSpace($localSpaceReference))
       #set ($spaceDocument = $xwiki.getDocument($spaceReference))
       #if ($spaceDocument)
    -    $spaceDocument.plainTitle
    +    $escapetool.xml($spaceDocument.plainTitle)
       #else
    -    $spaceReference.name
    +    $escapetool.xml($spaceReference.name)
       #end
     #end
     #macro (getSpaceFacetHierarchyPathData $spaceReference $return $options)
    
acba74c149a0

XWIKI-21471: Improve escaping in Solr Space Faucet

https://github.com/xwiki/xwiki-platformpjeanjeanNov 2, 2023via ghsa
10 files changed · +366 4
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml+1 1 modified
    @@ -42,7 +42,7 @@
         <profile>
           <id>integration-tests</id>
           <modules>
    -        <module>xwiki-platform-search-solr-test-utils</module>
    +        <module>xwiki-platform-search-solr-test</module>
           </modules>
         </profile>
       </profiles>
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml+57 0 added
    @@ -0,0 +1,57 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr</artifactId>
    +    <version>15.10-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Parent POM</name>
    +  <packaging>pom</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Parent POM</description>
    +  <properties>
    +    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
    +    <xwiki.revapi.skip>true</xwiki.revapi.skip>
    +    <!-- Don't run Checkstyle in test modules -->
    +    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
    +  </properties>
    +  <modules>
    +    <module>xwiki-platform-search-solr-test-pageobjects</module>
    +  </modules>
    +  <profiles>
    +    <profile>
    +      <id>integration-tests</id>
    +      <modules>
    +        <module>xwiki-platform-search-solr-test-utils</module>
    +      </modules>
    +    </profile>
    +    <profile>
    +      <id>docker</id>
    +      <modules>
    +        <module>xwiki-platform-search-solr-test-docker</module>
    +      </modules>
    +    </profile>
    +  </profiles>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml+102 0 added
    @@ -0,0 +1,102 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
    +    <version>15.10-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test-docker</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Functional Docker Tests</name>
    +  <packaging>jar</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Functional Tests in Docker</description>
    +  <properties>
    +    <!-- Functional tests are allowed to output content to the console -->
    +    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
    +  </properties>
    +  <dependencies>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-ui</artifactId>
    +      <version>${project.version}</version>
    +      <type>xar</type>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-test-docker</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
    +      <version>${project.version}</version>
    +      <scope>test</scope>
    +    </dependency>
    +  </dependencies>
    +  <build>
    +    <testSourceDirectory>src/test/it</testSourceDirectory>
    +    <plugins>
    +      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
    +      <plugin>
    +        <groupId>org.apache.maven.plugins</groupId>
    +        <artifactId>maven-failsafe-plugin</artifactId>
    +      </plugin>
    +    </plugins>
    +  </build>
    +  <profiles>
    +    <profile>
    +      <id>clover</id>
    +      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
    +           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
    +      <dependencies>
    +        <dependency>
    +          <groupId>org.openclover</groupId>
    +          <artifactId>clover</artifactId>
    +        </dependency>
    +      </dependencies>
    +      <build>
    +        <plugins>
    +          <plugin>
    +            <groupId>org.apache.maven.plugins</groupId>
    +            <artifactId>maven-failsafe-plugin</artifactId>
    +            <configuration>
    +              <systemPropertyVariables>
    +                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
    +                     WEB-INF/lib -->
    +                <xwiki.test.ui.profiles>clover</xwiki.test.ui.profiles>
    +              </systemPropertyVariables>
    +            </configuration>
    +          </plugin>
    +        </plugins>
    +      </build>
    +    </profile>
    +  </profiles>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java+37 0 added
    @@ -0,0 +1,37 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.ui;
    +
    +import org.junit.jupiter.api.Nested;
    +import org.xwiki.test.docker.junit5.UITest;
    +
    +/**
    + * All UI tests for the Solr Search feature.
    + *
    + * @version $Id$
    + */
    +@UITest
    +class AllIT
    +{
    +    @Nested
    +    class NestedSolrSearchIT extends SolrSearchIT
    +    {
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java+62 0 added
    @@ -0,0 +1,62 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.ui;
    +
    +import org.junit.jupiter.api.Test;
    +import org.xwiki.repository.test.SolrTestUtils;
    +import org.xwiki.search.solr.test.po.SolrSearchPage;
    +import org.xwiki.test.docker.junit5.TestConfiguration;
    +import org.xwiki.test.docker.junit5.UITest;
    +import org.xwiki.test.docker.junit5.servletengine.ServletEngine;
    +import org.xwiki.test.integration.XWikiExecutor;
    +import org.xwiki.test.ui.TestUtils;
    +
    +import static org.junit.jupiter.api.Assertions.assertEquals;
    +
    +/**
    + * Tests Solr search features.
    + *
    + * @version $Id$
    + */
    +@UITest
    +class SolrSearchIT
    +{
    +    @Test
    +    void verifySpaceFaucetEscaping(TestUtils setup, TestConfiguration testConfiguration) throws Exception {
    +        setup.loginAsSuperAdmin();
    +
    +        String testDocumentLocation = "{{/html}}";
    +        setup.createPage(testDocumentLocation, "WebHome", "Test Document", testDocumentLocation);
    +
    +        new SolrTestUtils(setup, computedHostURL(testConfiguration)).waitEmptyQueue();
    +
    +        SolrSearchPage searchPage = SolrSearchPage.gotoPage();
    +        searchPage.search("\"Test Document\"");
    +        searchPage.toggleSpaceFaucet();
    +        assertEquals(testDocumentLocation + "\n1", searchPage.getSpaceFaucetContent());
    +    }
    +
    +    private String computedHostURL(TestConfiguration testConfiguration)
    +    {
    +        ServletEngine servletEngine = testConfiguration.getServletEngine();
    +        return String.format("http://%s:%d%s", servletEngine.getIP(), servletEngine.getPort(),
    +            XWikiExecutor.DEFAULT_CONTEXT);
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml+45 0 added
    @@ -0,0 +1,45 @@
    +<?xml version="1.0" encoding="UTF-8"?>
    +<!--
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +-->
    +<project xmlns="http://maven.apache.org/POM/4.0.0"
    +  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    +  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    +  <modelVersion>4.0.0</modelVersion>
    +  <parent>
    +    <groupId>org.xwiki.platform</groupId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
    +    <version>15.10-SNAPSHOT</version>
    +  </parent>
    +  <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
    +  <name>XWiki Platform - Search - Solr - Tests - Page Objects</name>
    +  <packaging>jar</packaging>
    +  <description>XWiki Platform - Search - Solr - Tests - Page Objects</description>
    +  <properties>
    +    <!-- None of the classes is valid -->
    +    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
    +  </properties>
    +  <dependencies>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-test-ui</artifactId>
    +      <version>${project.version}</version>
    +    </dependency>
    +  </dependencies>
    +</project>
    \ No newline at end of file
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java+59 0 added
    @@ -0,0 +1,59 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.search.solr.test.po;
    +
    +import org.openqa.selenium.WebElement;
    +import org.openqa.selenium.support.FindBy;
    +import org.xwiki.test.ui.po.ViewPage;
    +
    +public class SolrSearchPage extends ViewPage
    +{
    +    @FindBy(id = "search-page-bar-input")
    +    private WebElement searchInput;
    +
    +    @FindBy(xpath = "//div[@class = 'search-ui']//button[@type = 'submit']")
    +    private WebElement searchButton;
    +
    +    @FindBy(xpath = "//div[@class = 'search-ui']//button[@aria-controls = 'space_facet-dropdown']")
    +    private WebElement spaceFaucetDropdownButton;
    +
    +    @FindBy(xpath = "//div[@id = 'space_facet-dropdown']")
    +    private WebElement spaceFaucetDropdownContent;
    +
    +    public static SolrSearchPage gotoPage()
    +    {
    +        getUtil().gotoPage("Main", "SolrSearch", "view");
    +        return new SolrSearchPage();
    +    }
    +
    +    public void search(String terms) {
    +        this.searchInput.clear();
    +        this.searchInput.sendKeys(terms);
    +        this.searchButton.click();
    +    }
    +
    +    public void toggleSpaceFaucet() {
    +        this.spaceFaucetDropdownButton.click();
    +    }
    +
    +    public String getSpaceFaucetContent() {
    +        return this.spaceFaucetDropdownContent.getText();
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml+1 1 renamed
    @@ -24,7 +24,7 @@
       <modelVersion>4.0.0</modelVersion>
       <parent>
         <groupId>org.xwiki.platform</groupId>
    -    <artifactId>xwiki-platform-search-solr</artifactId>
    +    <artifactId>xwiki-platform-search-solr-test</artifactId>
         <version>15.10-SNAPSHOT</version>
       </parent>
       <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
    
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java+0 0 renamed
  • xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml+2 2 modified
    @@ -42,9 +42,9 @@
       #set ($spaceReference = $services.model.resolveSpace($localSpaceReference))
       #set ($spaceDocument = $xwiki.getDocument($spaceReference))
       #if ($spaceDocument)
    -    $spaceDocument.plainTitle
    +    $escapetool.xml($spaceDocument.plainTitle)
       #else
    -    $spaceReference.name
    +    $escapetool.xml($spaceReference.name)
       #end
     #end
     #macro (getSpaceFacetHierarchyPathData $spaceReference $return $options)
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.