CVE-2025-58365
Description
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. No known workarounds are available.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.contrib.blog:application-blog-uiMaven | < 9.14 | 9.14 |
Affected products
1- Range: application-blog-9.10, application-blog-9.10.1, application-blog-9.10.10, …
Patches
283d5f24faf91[maven-release-plugin] prepare release application-blog-9.14
6 files changed · +7 −7
application-blog-api/pom.xml+1 −1 modified@@ -25,7 +25,7 @@ <parent> <groupId>org.xwiki.contrib.blog</groupId> <artifactId>application-blog</artifactId> - <version>9.13.13-SNAPSHOT</version> + <version>9.14</version> </parent> <artifactId>application-blog-api</artifactId> <name>Blog - API</name>
application-blog-test/application-blog-test-pageobjects/pom.xml+1 −1 modified@@ -25,7 +25,7 @@ <parent> <groupId>org.xwiki.contrib.blog</groupId> <artifactId>application-blog-test</artifactId> - <version>9.13.13-SNAPSHOT</version> + <version>9.14</version> </parent> <artifactId>application-blog-test-pageobjects</artifactId> <name>Blog - Tests - Page Objects</name>
application-blog-test/application-blog-test-tests/pom.xml+1 −1 modified@@ -25,7 +25,7 @@ <parent> <groupId>org.xwiki.contrib.blog</groupId> <artifactId>application-blog-test</artifactId> - <version>9.13.13-SNAPSHOT</version> + <version>9.14</version> </parent> <artifactId>application-blog-test-tests</artifactId> <name>Blog - Tests - Functional Tests</name>
application-blog-test/pom.xml+1 −1 modified@@ -25,7 +25,7 @@ <parent> <groupId>org.xwiki.contrib.blog</groupId> <artifactId>application-blog</artifactId> - <version>9.13.13-SNAPSHOT</version> + <version>9.14</version> </parent> <artifactId>application-blog-test</artifactId> <name>Blog - Tests - Parent POM</name>
application-blog-ui/pom.xml+1 −1 modified@@ -25,7 +25,7 @@ <parent> <groupId>org.xwiki.contrib.blog</groupId> <artifactId>application-blog</artifactId> - <version>9.13.13-SNAPSHOT</version> + <version>9.14</version> </parent> <!-- If someone has to change the ID, he must update org.xwiki.platform.blog.internal.BlogUpgradeEventListener to consider the new ID as well -->
pom.xml+2 −2 modified@@ -29,15 +29,15 @@ </parent> <groupId>org.xwiki.contrib.blog</groupId> <artifactId>application-blog</artifactId> - <version>9.13.13-SNAPSHOT</version> + <version>9.14</version> <name>Blog - Parent POM</name> <packaging>pom</packaging> <description>Create and manage blog posts</description> <scm> <connection>scm:git:git://github.com/xwiki-contrib/application-blog.git</connection> <developerConnection>scm:git:git@github.com:xwiki-contrib/application-blog.git</developerConnection> <url>https://github.com/xwiki-contrib/application-blog/tree/master</url> - <tag>HEAD</tag> + <tag>application-blog-9.14</tag> </scm> <developers> <developer>
b98ab6f17da3BLOG-191: Content is wrongly rendered
9 files changed · +328 −26
application-blog-api/pom.xml+12 −0 modified@@ -52,6 +52,11 @@ <groupId>javax.servlet</groupId> <artifactId>javax.servlet-api</artifactId> </dependency> + <dependency> + <groupId>org.xwiki.rendering</groupId> + <artifactId>xwiki-rendering-syntax-html5</artifactId> + <version>${rendering.version}</version> + </dependency> <!-- Test Dependencies --> <dependency> <groupId>org.xwiki.commons</groupId> @@ -66,5 +71,12 @@ <version>2.6.3</version> <scope>test</scope> </dependency> + <dependency> + <groupId>org.xwiki.platform</groupId> + <artifactId>xwiki-platform-oldcore</artifactId> + <version>${platform.version}</version> + <type>test-jar</type> + <scope>test</scope> + </dependency> </dependencies> </project> \ No newline at end of file
application-blog-api/src/main/java/org/xwiki/contrib/blog/script/BlogScriptService.java+111 −0 modified@@ -19,18 +19,31 @@ */ package org.xwiki.contrib.blog.script; +import java.util.Collections; + import javax.inject.Inject; import javax.inject.Named; import javax.inject.Provider; import javax.inject.Singleton; +import org.apache.commons.lang3.StringUtils; import org.xwiki.component.annotation.Component; +import org.xwiki.localization.ContextualLocalizationManager; +import org.xwiki.model.reference.EntityReferenceSerializer; +import org.xwiki.rendering.block.Block; +import org.xwiki.rendering.block.LinkBlock; +import org.xwiki.rendering.block.WordBlock; +import org.xwiki.rendering.listener.reference.DocumentResourceReference; +import org.xwiki.rendering.renderer.BlockRenderer; +import org.xwiki.rendering.renderer.printer.DefaultWikiPrinter; import org.xwiki.script.service.ScriptService; import org.xwiki.stability.Unstable; import com.xpn.xwiki.XWikiContext; import com.xpn.xwiki.XWikiException; import com.xpn.xwiki.api.Document; +import com.xpn.xwiki.api.Object; +import com.xpn.xwiki.api.Property; import com.xpn.xwiki.web.ExternalServletURLFactory; import com.xpn.xwiki.web.XWikiURLFactory; @@ -46,9 +59,26 @@ @Unstable public class BlogScriptService implements ScriptService { + + private static final String EXTRACT_PROPERTY_NAME = "extract"; + + private static final String PARAGRAPH_CLOSE_TAG = "</p>"; + + private static final String VIEW_MODE = "view"; + @Inject private Provider<XWikiContext> xwikiContextProvider; + @Inject + private ContextualLocalizationManager localizationManager; + + @Inject + @Named("html/5.0") + private BlockRenderer htmlRenderer; + + @Inject + private EntityReferenceSerializer<String> referenceSerializer; + /** * @param document the document containing the attachment * @param filename the document's attachment for which to generate an absolute URL for @@ -70,7 +100,9 @@ public String getExternalAttachmentURL(Document document, String filename) * @param blogDocument the document containing the content to render * @return the rendered content as HTML * @throws XWikiException if there's an error when rendering the content to HTML + * @deprecated Since 9.14, use {@link #renderContentHTML(Document, Object, boolean, boolean, boolean)} instead. */ + @Deprecated public String renderRSSDescription(String contentToRender, Document blogDocument) throws XWikiException { XWikiContext context = this.xwikiContextProvider.get(); @@ -82,4 +114,83 @@ public String renderRSSDescription(String contentToRender, Document blogDocument context.setURLFactory(currentURLFactory); } } + + /** + * Renders the content of the specified blog post document to HTML, with options for using the extract if available, + * adding ellipses, and generating external URLs. + * + * @param blogDocument the document representing the blog post + * @param blogPostObject the object containing the blog post data + * @param onlyExtract if true, renders the "extract" field of the blog post object (when present) instead of the + * full content + * @param removeEllipsis if true, no ellipsis ("...") will be appended to the extract + * @param externalURLs if true, forces URLs included in the rendered content to be external + * @return a string representing the rendered HTML content of the blog post + * @since 9.14 + */ + public String renderContentHTML(Document blogDocument, Object blogPostObject, boolean onlyExtract, + boolean removeEllipsis, boolean externalURLs) + { + XWikiContext context = this.xwikiContextProvider.get(); + XWikiURLFactory currentURLFactory = context.getURLFactory(); + try { + if (externalURLs) { + context.setURLFactory(new ExternalServletURLFactory(context)); + } + + boolean useExtract = onlyExtract && hasExtract(blogPostObject); + + String result; + + if (useExtract) { + result = unwrapHTMLMacro(blogDocument.display(EXTRACT_PROPERTY_NAME, VIEW_MODE, blogPostObject)); + + if (!removeEllipsis) { + String title = this.localizationManager.getTranslationPlain("blog.code.readpost"); + String stringReference = this.referenceSerializer.serialize(blogDocument.getDocumentReference()); + Block linkBlock = new LinkBlock( + Collections.singletonList(new WordBlock("…")), + new DocumentResourceReference(stringReference), + false, + Collections.singletonMap("title", title) + ); + DefaultWikiPrinter printer = new DefaultWikiPrinter(); + this.htmlRenderer.render(linkBlock, printer); + + String ellipsis = printer.toString(); + + // Check if the (trimmed) content ends with a closing paragraph tag. + // If yes, add the ellipsis inside that last paragraph, else add it as a new paragraph. + if (StringUtils.lastIndexOf(result, PARAGRAPH_CLOSE_TAG) > 0 + && StringUtils.isBlank(StringUtils.substringAfterLast(result, PARAGRAPH_CLOSE_TAG))) { + result = StringUtils.substringBeforeLast(result, + PARAGRAPH_CLOSE_TAG) + " " + ellipsis + PARAGRAPH_CLOSE_TAG; + } else { + result = result + "<p>" + ellipsis + PARAGRAPH_CLOSE_TAG; + } + } + } else { + result = unwrapHTMLMacro(blogDocument.display("content", VIEW_MODE, blogPostObject)); + } + + return result; + } finally { + if (externalURLs) { + context.setURLFactory(currentURLFactory); + } + } + } + + private static String unwrapHTMLMacro(String input) + { + return StringUtils.removeEnd(StringUtils.removeStart(input, "{{html clean=\"false\" wiki=\"false\"}}"), + "{{/html}}"); + } + + private static boolean hasExtract(Object blogPostObject) + { + Property extractProperty = blogPostObject.getProperty(EXTRACT_PROPERTY_NAME); + return extractProperty != null && extractProperty.getValue() != null + && StringUtils.isNotBlank(extractProperty.getValue().toString()); + } }
application-blog-api/src/test/java/org/xwiki/contrib/blog/script/BlogScriptServiceTest.java+188 −0 added@@ -0,0 +1,188 @@ +/* + * See the NOTICE file distributed with this work for additional + * information regarding copyright ownership. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.xwiki.contrib.blog.script; + +import java.net.URL; + +import javax.inject.Provider; + +import org.junit.Before; +import org.junit.Rule; +import org.junit.Test; +import org.xwiki.component.manager.ComponentManager; +import org.xwiki.localization.ContextualLocalizationManager; +import org.xwiki.model.reference.DocumentReference; +import org.xwiki.rendering.internal.renderer.html5.HTML5BlockRenderer; +import org.xwiki.rendering.internal.renderer.html5.HTML5Renderer; +import org.xwiki.rendering.internal.renderer.html5.HTML5RendererFactory; +import org.xwiki.rendering.internal.renderer.xhtml.image.DefaultXHTMLImageRenderer; +import org.xwiki.rendering.internal.renderer.xhtml.image.DefaultXHTMLImageTypeRenderer; +import org.xwiki.rendering.internal.renderer.xhtml.link.DefaultXHTMLLinkRenderer; +import org.xwiki.rendering.internal.renderer.xhtml.link.DefaultXHTMLLinkTypeRenderer; +import org.xwiki.resource.internal.entity.EntityResourceActionLister; +import org.xwiki.test.annotation.ComponentList; +import org.xwiki.test.mockito.MockitoComponentMockingRule; + +import com.xpn.xwiki.XWiki; +import com.xpn.xwiki.XWikiContext; +import com.xpn.xwiki.api.Document; +import com.xpn.xwiki.api.Object; +import com.xpn.xwiki.api.Property; +import com.xpn.xwiki.test.reference.ReferenceComponentList; +import com.xpn.xwiki.web.ExternalServletURLFactory; +import com.xpn.xwiki.web.Utils; +import com.xpn.xwiki.web.XWikiRequest; +import com.xpn.xwiki.web.XWikiURLFactory; + +import static org.junit.Assert.assertEquals; +import static org.mockito.Mockito.any; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; + +/** + * Unit test for {@link BlogScriptService}. + * + * @version $Id$ + */ +@ReferenceComponentList +@ComponentList({ + HTML5BlockRenderer.class, + HTML5Renderer.class, + HTML5RendererFactory.class, + DefaultXHTMLLinkRenderer.class, + DefaultXHTMLLinkTypeRenderer.class, + DefaultXHTMLImageRenderer.class, + DefaultXHTMLImageTypeRenderer.class +}) +public class BlogScriptServiceTest +{ + private static final DocumentReference DOCUMENT_REFERENCE = new DocumentReference("wiki", "TestBlog", "HelloWorld"); + + @Rule + public MockitoComponentMockingRule<BlogScriptService> mocker = + new MockitoComponentMockingRule<>(BlogScriptService.class); + + BlogScriptService blogScriptService; + + private ContextualLocalizationManager localizationManager; + + private XWikiContext xwikiContext; + + private Document blogDocument; + + private Object blogPostObject; + + private Property extractProperty; + + @Before + public void setUp() throws Exception + { + this.blogDocument = mock(Document.class); + when(this.blogDocument.getDocumentReference()).thenReturn(DOCUMENT_REFERENCE); + this.blogPostObject = mock(Object.class); + this.extractProperty = mock(Property.class); + when(this.blogPostObject.getProperty("extract")).thenReturn(this.extractProperty); + Provider<XWikiContext> contextProvider = this.mocker.registerMockComponent(XWikiContext.TYPE_PROVIDER); + this.blogScriptService = this.mocker.getComponentUnderTest(); + this.localizationManager = this.mocker.getInstance(ContextualLocalizationManager.class); + this.xwikiContext = mock(XWikiContext.class); + when(contextProvider.get()).thenReturn(this.xwikiContext); + Utils.setComponentManager(this.mocker); + this.mocker.registerMockComponent(EntityResourceActionLister.class); + this.mocker.registerComponent(ComponentManager.class, "context", this.mocker); + + XWiki mockXWiki = mock(XWiki.class); + when(this.xwikiContext.getWiki()).thenReturn(mockXWiki); + when(mockXWiki.getWebAppPath(this.xwikiContext)).thenReturn("xwiki/"); + when(this.xwikiContext.getURL()).thenReturn(new URL("https://www.example.com/xwiki/bin/view/Test")); + when(this.xwikiContext.getRequest()).thenReturn(mock(XWikiRequest.class)); + } + + @Test + public void testRenderContentHTMLWithExtractAndRemoveEllipsis() + { + when(this.extractProperty.getValue()).thenReturn("Test Extract"); + when(this.blogDocument.display("extract", "view", this.blogPostObject)).thenReturn( + "{{html clean=\"false\" wiki=\"false\"}}<p>Test Extract</p>{{/html}}"); + + String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, true, true, false); + + assertEquals("<p>Test Extract</p>", result); + verify(this.xwikiContext, never()).setURLFactory(any()); + } + + @Test + public void testRenderContentHTMLWithoutExtractAndRemoveEllipsis() + { + when(this.blogPostObject.getProperty("extract")).thenReturn(null); + when(this.blogDocument.display("content", "view", this.blogPostObject)).thenReturn( + "{{html clean=\"false\" wiki=\"false\"}}<p>Full Content</p>{{/html}}"); + + String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, true, true, false); + + assertEquals("<p>Full Content</p>", result); + verify(this.xwikiContext, never()).setURLFactory(any()); + } + + @Test + public void testRenderContentHTMLWithExtractAndEllipsis() + { + when(this.extractProperty.getValue()).thenReturn("Test Extract"); + when(this.blogDocument.display("extract", "view", this.blogPostObject)).thenReturn( + "{{html clean=\"false\" wiki=\"false\"}}<p>Test Extract</p>{{/html}}"); + when(this.localizationManager.getTranslationPlain("blog.code.readpost")).thenReturn("Read more"); + + String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, true, false, false); + + assertEquals( + "<p>Test Extract <span class=\"wikiexternallink\">" + + "<a title=\"Read more\" href=\"wiki:TestBlog.HelloWorld\">…</a></span></p>", result); + verify(this.xwikiContext, never()).setURLFactory(any()); + } + + @Test + public void testRenderContentHTMLWithoutExtractAndEllipsis() + { + when(this.blogDocument.display("content", "view", this.blogPostObject)).thenReturn( + "{{html clean=\"false\" wiki=\"false\"}}<p>Full Content</p>{{/html}}"); + + String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, false, false, false); + + assertEquals("<p>Full Content</p>", result); + verify(this.xwikiContext, never()).setURLFactory(any()); + } + + @Test + public void testRenderContentHTMLWithExternalURLs() + { + XWikiURLFactory urlFactory = mock(XWikiURLFactory.class); + when(this.xwikiContext.getURLFactory()).thenReturn(urlFactory); + when(this.blogDocument.display("content", "view", this.blogPostObject)).thenReturn( + "{{html clean=\"false\" wiki=\"false\"}}<p>Full Content</p>{{/html}}"); + + String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, false, false, true); + + assertEquals("<p>Full Content</p>", result); + verify(this.xwikiContext).setURLFactory(any(ExternalServletURLFactory.class)); + verify(this.xwikiContext).setURLFactory(urlFactory); + } +}
application-blog-ui/src/main/resources/Blog/BlogCode.xml+10 −5 modified@@ -732,12 +732,14 @@ $!xwiki.jsx.use($blogScriptsDocumentName)## * @param entryObj The xobject of the blog post, an instance of the <tt>Blog.BlogPostClass</tt> xclass. *### #macro(displayEntryTitle $entryDoc $entryObj) + #set($escapedRenderedTitle = $services.rendering.escape($entryDoc.display('title', 'view', $entryObj), $xwiki.getCurrentContentSyntaxId())) #if($doc.fullName == $entryDoc.fullName) (% class="entry-title" %) - = $services.rendering.escape($entryDoc.display('title', 'view', $entryObj), $xwiki.getCurrentContentSyntaxId()) = + = $escapedRenderedTitle = #else (% class="entry-title" %) - === [[$services.rendering.escape($entryDoc.display('title', 'view', $entryObj),$xwiki.getCurrentContentSyntaxId())>>doc:$services.rendering.escape($services.model.serialize($entryDoc.getDocumentReference(),'default'),$xwiki.getCurrentContentSyntaxId())]] === + ## Link content requires double escaping. + === [[$services.rendering.escape($escapedRenderedTitle,$xwiki.getCurrentContentSyntaxId())>>doc:$services.rendering.escape($services.model.serialize($entryDoc.getDocumentReference(),'default'),$xwiki.getCurrentContentSyntaxId())]] === #end #end ## @@ -752,10 +754,9 @@ $!xwiki.jsx.use($blogScriptsDocumentName)## *### #macro(displayEntryContent $entryDoc $entryObj $onlyExtract) (% class="#if($onlyExtract)entry-summary#{else}entry-content#end" %)((( - #getEntryContent($entryDoc $entryObj $onlyExtract $entryContent) ## FIXME: This causes the blog's content to not be annotatable. See http://jira.xwiki.org/browse/XWIKI-6328 ## Should probably be replaced by a display macro call with a reference to the object property holding the post's content - {{html wiki="false"}}$entryDoc.getRenderedContent($entryContent, $entryDoc.syntax.toIdString()){{/html}} + {{html wiki="false"}}$services.blog.renderContentHTML($entryDoc, $entryObj, $onlyExtract, false, false){{/html}} ))) ## entry-content (% class="clearfloats" %)((())) #end @@ -772,6 +773,7 @@ $!xwiki.jsx.use($blogScriptsDocumentName)## * @param entryContent The resulting content. * @param removeEllipsis If <tt>true</tt>, then don't display an ellipsis at the end of the content (only used when * <tt>onlyExtract</tt> is <tt>true</tt>) + * @deprecated Use $services.blog.renderContentHTML instead. *### #macro(getEntryContent $entryDoc $entryObj $onlyExtract $entryContent $removeEllipsis) #if ($onlyExtract) @@ -875,7 +877,10 @@ $!xwiki.jsx.use($blogScriptsDocumentName)## #else , ## #end## - [[$!{categoryDoc.getObject($blogCategoryClassname).getValue('name')}>>${category}||rel='tag']]## + #set($escapedName = $services.rendering.escape($categoryDoc.getObject($blogCategoryClassname).getValue('name'), $xwiki.getCurrentContentSyntaxId())) + #set($escapedName = $services.rendering.escape($escapedName, $xwiki.getCurrentContentSyntaxId())) + #set($escapedCategory = $services.rendering.escape($category, $xwiki.getCurrentContentSyntaxId())) + [[$!{escapedName}>>${escapedCategory}||rel='tag']]## #end## #end## #end
application-blog-ui/src/main/resources/Blog/BlogPostLayoutCards.xml+3 −2 modified@@ -485,8 +485,9 @@ #end #if ($displaySummaryOnPinnedPosts) <div class="text-left post-summary"> - #set ($postContent = $pObj.getProperty('extract').value) - $!pDoc.getRenderedContent($postContent, $pDoc.syntax.toIdString()) + #if ($stringtool.isNotBlank($pObj.getProperty('extract').value)) + $services.blog.renderContentHTML($pDoc, $pObj, true, true, false) + #end </div> #end #displayPostDetails($pDoc)
application-blog-ui/src/main/resources/Blog/BlogPostLayoutImage.xml+1 −10 modified@@ -229,16 +229,7 @@ </div> #if($displayTitle)<h3 class="entry-title"><span class="wikilink"><a href="$postDoc.uRL">$!postDoc.display('title', 'view', $postObj)</a></span></h3>#end <div> - #set ($postContent = "") - ## Note: We trim the summary so that if there's some white space it won't cause the summary to be used instead - ## of the content. - #if ($useSummary) - #set ($postContent = $postObj.getProperty('extract').value.trim()) - #end - #if ("$!postContent" == '') - #set ($postContent = $postObj.getProperty('content').value) - #end - {{html wiki="false"}}$!postDoc.getRenderedContent($postContent, $postDoc.syntax.toIdString()){{/html}} + {{html wiki="false"}}$services.blog.renderContentHTML($postDoc, $postObj, $useSummary, false, false){{/html}} </div> #displayEntryFooter($postDoc $postObj) </div>
application-blog-ui/src/main/resources/Blog/CategoriesCode.xml+1 −1 modified@@ -367,7 +367,7 @@ #macro(displaySimpleCategory $name $level) #getEntriesForCategory($name $discard $totalEntries) #set($nameUrl = $escapetool.url($name)) - #foreach($i in [1..$level])*#end (% class="blog-category-level" %)((( [[#toolImage('rss')>>$name||queryString="xpage=plain&sheet=Blog.CategoryRss" title="RSS"]] <span class="wikilink"><a href="$services.rendering.escape($xwiki.getURL($name), $xwiki.getCurrentContentSyntaxId())">#getCategoryName($xwiki.getDocument($name)) <span class="itemCount">($totalEntries)</span></a></span>))) + #foreach($i in [1..$level])*#end (% class="blog-category-level" %)((( [[#toolImage('rss')>>$services.rendering.escape($name, $xwiki.getCurrentContentSyntaxId())||queryString="xpage=plain&sheet=Blog.CategoryRss" title="RSS"]] <span class="wikilink"><a href="$services.rendering.escape($xwiki.getURL($name), $xwiki.getCurrentContentSyntaxId())">#getCategoryName($xwiki.getDocument($name)) <span class="itemCount">($totalEntries)</span></a></span>))) #end ## ##
application-blog-ui/src/main/resources/Blog/CategorySheet.xml+1 −1 modified@@ -47,7 +47,7 @@ #set ($obj = $doc.getObject($blogCategoryClassname)) #if ($obj) #if ($tdoc.content.trim() != '') - {{html}}$tdoc.getRenderedContent($tdoc.content, $tdoc.syntax.toIdString()).replace('{{', '&amp;#123;&amp;#123;'){{/html}} + {{include reference="" author="target"/}} #end {{html wiki=true}}
application-blog-ui/src/main/resources/Blog/RssCode.xml+1 −7 modified@@ -281,13 +281,7 @@ #macro(printBlogRssItem $entryDoc) #set($entryUrl = $entryDoc.getExternalURL('view', "language=${entryDoc.realLocale}")) #getEntryObject($entryDoc $entryObj) - #getEntryContent($entryDoc $entryObj true $entryContent true) - #if($!entryDoc.syntax.toIdString() == 'xwiki/1.0') - #set($desc = $entryContent) - #else - #set($desc = $services.blog.renderRSSDescription($entryContent, $entryDoc)) - #end - #set($desc = $escapetool.xml($desc)) + #set($desc = $escapetool.xml($services.blog.renderContentHTML($entryDoc, $entryObj, true, true, true))) <item rdf:about="$entryUrl"> <title>$escapetool.xml($entryDoc.getValue('title'))</title> <link>$entryUrl</link>
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-gwj6-xpfg-pxwrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-58365ghsaADVISORY
- github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4nvdWEB
- github.com/xwiki-contrib/application-blog/security/advisories/GHSA-gwj6-xpfg-pxwrnvdWEB
- jira.xwiki.org/browse/BLOG-191nvdWEB
News mentions
0No linked articles in our index yet.