CVE-2024-31984: Insufficient Information (NVD-CWE-noinfo)
value: XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the `Main.SolrSpaceFacet` page.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T20:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml, xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml
Commit date: 2023-11-02 15:12:43 +0100
Commit message: XWIKI-21471: Improve escaping in Solr Space Faucet

Diff: diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml
index fc0d964ca6194..98fea58016bbf 100644
--- a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml
@@ -40,10 +40,10 @@
   </modules>
   <profiles>
     <profile>
       <id>integration-tests</id>
       <modules>
-        <module>xwiki-platform-search-solr-test-utils</module>
+        <module>xwiki-platform-search-solr-test</module>
       </modules>
     </profile>
   </profiles>
 </project>
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
new file mode 100644
index 0000000000000..9b41fddfccbff
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-search-solr</artifactId>
+    <version>15.10-SNAPSHOT</version>
+  </parent>
+  <artifactId>xwiki-platform-search-solr-test</artifactId>
+  <name>XWiki Platform - Search - Solr - Tests - Parent POM</name>
+  <packaging>pom</packaging>
+  <description>XWiki Platform - Search - Solr - Tests - Parent POM</description>
+  <properties>
+    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
+    <xwiki.revapi.skip>true</xwiki.revapi.skip>
+    <!-- Don't run Checkstyle in test modules -->
+    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
+  </properties>
+  <modules>
+    <module>xwiki-platform-search-solr-test-pageobjects</module>
+  </modules>
+  <profiles>
+    <profile>
+      <id>integration-tests</id>
+      <modules>
+        <module>xwiki-platform-search-solr-test-utils</module>
+      </modules>
+    </profile>
+    <profile>
+      <id>docker</id>
+      <modules>
+        <module>xwiki-platform-search-solr-test-docker</module>
+      </modules>
+    </profile>
+  </profiles>
+</project>
\ No newline at end of file
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml
new file mode 100644
index 0000000000000..0eece31917a43
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/pom.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-search-solr-test</artifactId>
+    <version>15.10-SNAPSHOT</version>
+  </parent>
+  <artifactId>xwiki-platform-search-solr-test-docker</artifactId>
+  <name>XWiki Platform - Search - Solr - Tests - Functional Docker Tests</name>
+  <packaging>jar</packaging>
+  <description>XWiki Platform - Search - Solr - Tests - Functional Tests in Docker</description>
+  <properties>
+    <!-- Functional tests are allowed to output content to the console -->
+    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-search-solr-ui</artifactId>
+      <version>${project.version}</version>
+      <type>xar</type>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-test-docker</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+  <build>
+    <testSourceDirectory>src/test/it</testSourceDirectory>
+    <plugins>
+      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-failsafe-plugin</artifactId>
+      </plugin>
+    </plugins>
+  </build>
+  <profiles>
+    <profile>
+      <id>clover</id>
+      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
+           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
+      <dependencies>
+        <dependency>
+          <groupId>org.openclover</groupId>
+          <artifactId>clover</artifactId>
+        </dependency>
+      </dependencies>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-failsafe-plugin</artifactId>
+            <configuration>
+              <systemPropertyVariables>
+                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
+                     WEB-INF/lib -->
+                <xwiki.test.ui.profiles>clover</xwiki.test.ui.profiles>
+              </systemPropertyVariables>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
+</project>
\ No newline at end of file
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java
new file mode 100644
index 0000000000000..6d4d60deb7bed
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/AllIT.java
@@ -0,0 +1,37 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.search.solr.test.ui;
+
+import org.junit.jupiter.api.Nested;
+import org.xwiki.test.docker.junit5.UITest;
+
+/**
+ * All UI tests for the Solr Search feature.
+ *
+ * @version $Id$
+ */
+@UITest
+class AllIT
+{
+    @Nested
+    class NestedSolrSearchIT extends SolrSearchIT
+    {
+    }
+}
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java
new file mode 100644
index 0000000000000..68f1fbe9b0d44
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-docker/src/test/it/org/xwiki/search/solr/test/ui/SolrSearchIT.java
@@ -0,0 +1,62 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.search.solr.test.ui;
+
+import org.junit.jupiter.api.Test;
+import org.xwiki.repository.test.SolrTestUtils;
+import org.xwiki.search.solr.test.po.SolrSearchPage;
+import org.xwiki.test.docker.junit5.TestConfiguration;
+import org.xwiki.test.docker.junit5.UITest;
+import org.xwiki.test.docker.junit5.servletengine.ServletEngine;
+import org.xwiki.test.integration.XWikiExecutor;
+import org.xwiki.test.ui.TestUtils;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Tests Solr search features.
+ *
+ * @version $Id$
+ */
+@UITest
+class SolrSearchIT
+{
+    @Test
+    void verifySpaceFaucetEscaping(TestUtils setup, TestConfiguration testConfiguration) throws Exception {
+        setup.loginAsSuperAdmin();
+
+        String testDocumentLocation = "{{/html}}";
+        setup.createPage(testDocumentLocation, "WebHome", "Test Document", testDocumentLocation);
+
+        new SolrTestUtils(setup, computedHostURL(testConfiguration)).waitEmptyQueue();
+
+        SolrSearchPage searchPage = SolrSearchPage.gotoPage();
+        searchPage.search("\"Test Document\"");
+        searchPage.toggleSpaceFaucet();
+        assertEquals(testDocumentLocation + "\n1", searchPage.getSpaceFaucetContent());
+    }
+
+    private String computedHostURL(TestConfiguration testConfiguration)
+    {
+        ServletEngine servletEngine = testConfiguration.getServletEngine();
+        return String.format("http://%s:%d%s", servletEngine.getIP(), servletEngine.getPort(),
+            XWikiExecutor.DEFAULT_CONTEXT);
+    }
+}
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml
new file mode 100644
index 0000000000000..c265c8472322c
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/pom.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-search-solr-test</artifactId>
+    <version>15.10-SNAPSHOT</version>
+  </parent>
+  <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
+  <name>XWiki Platform - Search - Solr - Tests - Page Objects</name>
+  <packaging>jar</packaging>
+  <description>XWiki Platform - Search - Solr - Tests - Page Objects</description>
+  <properties>
+    <!-- None of the classes is valid -->
+    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-test-ui</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+  </dependencies>
+</project>
\ No newline at end of file
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java
new file mode 100644
index 0000000000000..c42240ecbc58f
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-pageobjects/src/main/java/org/xwiki/search/solr/test/po/SolrSearchPage.java
@@ -0,0 +1,59 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.search.solr.test.po;
+
+import org.openqa.selenium.WebElement;
+import org.openqa.selenium.support.FindBy;
+import org.xwiki.test.ui.po.ViewPage;
+
+public class SolrSearchPage extends ViewPage
+{
+    @FindBy(id = "search-page-bar-input")
+    private WebElement searchInput;
+
+    @FindBy(xpath = "//div[@class = 'search-ui']//button[@type = 'submit']")
+    private WebElement searchButton;
+
+    @FindBy(xpath = "//div[@class = 'search-ui']//button[@aria-controls = 'space_facet-dropdown']")
+    private WebElement spaceFaucetDropdownButton;
+
+    @FindBy(xpath = "//div[@id = 'space_facet-dropdown']")
+    private WebElement spaceFaucetDropdownContent;
+
+    public static SolrSearchPage gotoPage()
+    {
+        getUtil().gotoPage("Main", "SolrSearch", "view");
+        return new SolrSearchPage();
+    }
+
+    public void search(String terms) {
+        this.searchInput.clear();
+        this.searchInput.sendKeys(terms);
+        this.searchButton.click();
+    }
+
+    public void toggleSpaceFaucet() {
+        this.spaceFaucetDropdownButton.click();
+    }
+
+    public String getSpaceFaucetContent() {
+        return this.spaceFaucetDropdownContent.getText();
+    }
+}
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test-utils/pom.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml
similarity index 96%
rename from xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test-utils/pom.xml
rename to xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml
index 319502222c0fc..5eecf0c09ba17 100644
--- a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test-utils/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/pom.xml
@@ -22,11 +22,11 @@
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
   <modelVersion>4.0.0</modelVersion>
   <parent>
     <groupId>org.xwiki.platform</groupId>
-    <artifactId>xwiki-platform-search-solr</artifactId>
+    <artifactId>xwiki-platform-search-solr-test</artifactId>
     <version>15.10-SNAPSHOT</version>
   </parent>
   <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
   <name>XWiki Platform - Search - Solr - Tests - Utils</name>
   <packaging>jar</packaging>
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java
similarity index 100%
rename from xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java
rename to xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/xwiki-platform-search-solr-test-utils/src/main/java/org/xwiki/repository/test/SolrTestUtils.java
diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml
index 487f825f87193..4722591015cb6 100644
--- a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSpaceFacet.xml
@@ -40,13 +40,13 @@
 #macro (displaySearchFacetValue_space $facetPrettyValue)
   #set ($localSpaceReference = $stringtool.removeEnd($stringtool.substringAfter($facetValue.name, '/'), '.'))
   #set ($spaceReference = $services.model.resolveSpace($localSpaceReference))
   #set ($spaceDocument = $xwiki.getDocument($spaceReference))
   #if ($spaceDocument)
-    $spaceDocument.plainTitle
+    $escapetool.xml($spaceDocument.plainTitle)
   #else
-    $spaceReference.name
+    $escapetool.xml($spaceReference.name)
   #end
 #end
 #macro (getSpaceFacetHierarchyPathData $spaceReference $return $options)
   #getHierarchyPath($spaceReference $path $options)
   #getHierarchyPathLabels($path $labels $options)

Vulnerable code:         <module>xwiki-platform-search-solr-test-utils</module>
    <artifactId>xwiki-platform-search-solr</artifactId>
    $spaceDocument.plainTitle
    $spaceReference.name
Fixed code:         <module>xwiki-platform-search-solr-test</module>
<?xml version="1.0" encoding="UTF-8"?>
<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-search-solr</artifactId>
    <version>15.10-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-search-solr-test</artifactId>
  <name>XWiki Platform - Search - Solr - Tests - Parent POM</name>
  <packaging>pom</packaging>
  <description>XWiki Platform - Search - Solr - Tests - Parent POM</description>
  <properties>
    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
    <xwiki.revapi.skip>true</xwiki.revapi.skip>
    <!-- Don't run Checkstyle in test modules -->
    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
  </properties>
  <modules>
    <module>xwiki-platform-search-solr-test-pageobjects</module>
  </modules>
  <profiles>
    <profile>
      <id>integration-tests</id>
      <modules>
        <module>xwiki-platform-search-solr-test-utils</module>
      </modules>
    </profile>
    <profile>
      <id>docker</id>
      <modules>
        <module>xwiki-platform-search-solr-test-docker</module>
      </modules>
    </profile>
  </profiles>
</project>
<?xml version="1.0" encoding="UTF-8"?>
<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-search-solr-test</artifactId>
    <version>15.10-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-search-solr-test-docker</artifactId>
  <name>XWiki Platform - Search - Solr - Tests - Functional Docker Tests</name>
  <packaging>jar</packaging>
  <description>XWiki Platform - Search - Solr - Tests - Functional Tests in Docker</description>
  <properties>
    <!-- Functional tests are allowed to output content to the console -->
    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-search-solr-ui</artifactId>
      <version>${project.version}</version>
      <type>xar</type>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-docker</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-search-solr-test-utils</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <testSourceDirectory>src/test/it</testSourceDirectory>
    <plugins>
      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
      </plugin>
    </plugins>
  </build>
  <profiles>
    <profile>
      <id>clover</id>
      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
      <dependencies>
        <dependency>
          <groupId>org.openclover</groupId>
          <artifactId>clover</artifactId>
        </dependency>
      </dependencies>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-failsafe-plugin</artifactId>
            <configuration>
              <systemPropertyVariables>
                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
                     WEB-INF/lib -->
                <xwiki.test.ui.profiles>clover</xwiki.test.ui.profiles>
              </systemPropertyVariables>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.search.solr.test.ui;

import org.junit.jupiter.api.Nested;
import org.xwiki.test.docker.junit5.UITest;

/**
 * All UI tests for the Solr Search feature.
 *
 * @version $Id$
 */
@UITest
class AllIT
{
    @Nested
    class NestedSolrSearchIT extends SolrSearchIT
    {
    }
}
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.search.solr.test.ui;

import org.junit.jupiter.api.Test;
import org.xwiki.repository.test.SolrTestUtils;
import org.xwiki.search.solr.test.po.SolrSearchPage;
import org.xwiki.test.docker.junit5.TestConfiguration;
import org.xwiki.test.docker.junit5.UITest;
import org.xwiki.test.docker.junit5.servletengine.ServletEngine;
import org.xwiki.test.integration.XWikiExecutor;
import org.xwiki.test.ui.TestUtils;

import static org.junit.jupiter.api.Assertions.assertEquals;

/**
 * Tests Solr search features.
 *
 * @version $Id$
 */
@UITest
class SolrSearchIT
{
    @Test
    void verifySpaceFaucetEscaping(TestUtils setup, TestConfiguration testConfiguration) throws Exception {
        setup.loginAsSuperAdmin();

        String testDocumentLocation = "{{/html}}";
        setup.createPage(testDocumentLocation, "WebHome", "Test Document", testDocumentLocation);

        new SolrTestUtils(setup, computedHostURL(testConfiguration)).waitEmptyQueue();

        SolrSearchPage searchPage = SolrSearchPage.gotoPage();
        searchPage.search("\"Test Document\"");
        searchPage.toggleSpaceFaucet();
        assertEquals(testDocumentLocation + "\n1", searchPage.getSpaceFaucetContent());
    }

    private String computedHostURL(TestConfiguration testConfiguration)
    {
        ServletEngine servletEngine = testConfiguration.getServletEngine();
        return String.format("http://%s:%d%s", servletEngine.getIP(), servletEngine.getPort(),
            XWikiExecutor.DEFAULT_CONTEXT);
    }
}
<?xml version="1.0" encoding="UTF-8"?>
<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-search-solr-test</artifactId>
    <version>15.10-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-search-solr-test-pageobjects</artifactId>
  <name>XWiki Platform - Search - Solr - Tests - Page Objects</name>
  <packaging>jar</packaging>
  <description>XWiki Platform - Search - Solr - Tests - Page Objects</description>
  <properties>
    <!-- None of the classes is valid -->
    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-ui</artifactId>
      <version>${project.version}</version>
    </dependency>
  </dependencies>
</project>
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.search.solr.test.po;

import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;
import org.xwiki.test.ui.po.ViewPage;

public class SolrSearchPage extends ViewPage
{
    @FindBy(id = "search-page-bar-input")
    private WebElement searchInput;

    @FindBy(xpath = "//div[@class = 'search-ui']//button[@type = 'submit']")
    private WebElement searchButton;

    @FindBy(xpath = "//div[@class = 'search-ui']//button[@aria-controls = 'space_facet-dropdown']")
    private WebElement spaceFaucetDropdownButton;

    @FindBy(xpath = "//div[@id = 'space_facet-dropdown']")
    private WebElement spaceFaucetDropdownContent;

    public static SolrSearchPage gotoPage()
    {
        getUtil().gotoPage("Main", "SolrSearch", "view");
        return new SolrSearchPage();
    }

    public void search(String terms) {
        this.searchInput.clear();
        this.searchInput.sendKeys(terms);
        this.searchButton.click();
    }

    public void toggleSpaceFaucet() {
        this.spaceFaucetDropdownButton.click();
    }

    public String getSpaceFaucetContent() {
        return this.spaceFaucetDropdownContent.getText();
    }
}
    <artifactId>xwiki-platform-search-solr-test</artifactId>
    $escapetool.xml($spaceDocument.plainTitle)
    $escapetool.xml($spaceReference.name)