CVE-2023-35166: Insufficient Information (NVD-CWE-noinfo)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2023-06-20T20:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-help/pom.xml, xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/pom.xml, xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/pom.xml, xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/AllITs.java, xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/TipsPanelIT.java, xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/main/resources/Help/TipsPanel/WebHome.xml, xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java, xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java
Commit date: 2023-02-01 17:51:02 +0100
Commit message: XWIKI-20281: Improve tips rendering

Diff: diff --git a/xwiki-platform-core/xwiki-platform-help/pom.xml b/xwiki-platform-core/xwiki-platform-help/pom.xml
index 75b3afcf424a4..d3e3db6a191e3 100644
--- a/xwiki-platform-core/xwiki-platform-help/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-help/pom.xml
@@ -32,6 +32,14 @@
   <packaging>pom</packaging>
   <description>Provides help within your wiki and showcases the main XWiki features through demo content</description>
   <modules>
     <module>xwiki-platform-help-ui</module>
   </modules>
+  <profiles>
+    <profile>
+      <id>integration-tests</id>
+      <modules>
+        <module>xwiki-platform-help-test</module>
+      </modules>
+    </profile>
+  </profiles>
 </project>
diff --git a/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/pom.xml b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/pom.xml
new file mode 100644
index 0000000000000..8e636334a9ce8
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/pom.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-help</artifactId>
+    <version>15.1-SNAPSHOT</version>
+  </parent>
+  <artifactId>xwiki-platform-help-test</artifactId>
+  <name>XWiki Platform - Panels - Help - Parent POM</name>
+  <packaging>pom</packaging>
+  <description>XWiki Platform - Help - Tests - Parent POM</description>
+  <properties>
+    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
+    <xwiki.revapi.skip>true</xwiki.revapi.skip>
+    <!-- Don't run Checkstyle in test modules -->
+    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
+  </properties>
+  <profiles>
+    <profile>
+      <id>docker</id>
+      <modules>
+        <module>xwiki-platform-panels-test-docker</module>
+      </modules>
+    </profile>
+  </profiles>
+</project>
diff --git a/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/pom.xml b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/pom.xml
new file mode 100644
index 0000000000000..ed54654f1b85f
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/pom.xml
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <parent>
+    <artifactId>xwiki-platform-help-test</artifactId>
+    <groupId>org.xwiki.platform</groupId>
+    <version>15.1-SNAPSHOT</version>
+  </parent>
+  <modelVersion>4.0.0</modelVersion>
+  <artifactId>xwiki-platform-help-test-docker</artifactId>
+  <!-- TODO: Move to use "functional-test" in the future when http://jira.codehaus.org/browse/MNG-1911 is fixed,
+       see https://jira.xwiki.org/browse/XWIKI-7683 -->
+  <packaging>jar</packaging>
+  <name>XWiki Platform - Help - Tests - Functional Docker Tests</name>
+  <description>XWiki Platform - Help - Tests - Functional Tests in Docker</description>
+  <properties>
+    <!-- Functional tests are allowed to output content to the console -->
+    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
+  </properties>
+  <dependencies>
+    <!-- =========================================
+         Runtime Dependencies for tested features.
+         ========================================= -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-help-ui</artifactId>
+      <version>${project.version}</version>
+      <scope>runtime</scope>
+      <type>xar</type>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-panels-ui</artifactId>
+      <version>${project.version}</version>
+      <scope>runtime</scope>
+      <type>xar</type>
+    </dependency>
+
+    <!-- ================================
+         Test only dependencies
+         ================================ -->
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-test-docker</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-panels-test-pageobjects</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+  <build>
+    <testSourceDirectory>src/test/it</testSourceDirectory>
+    <plugins>
+      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-failsafe-plugin</artifactId>
+      </plugin>
+    </plugins>
+  </build>
+  <profiles>
+    <profile>
+      <id>clover</id>
+      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
+           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
+      <dependencies>
+        <dependency>
+          <groupId>org.openclover</groupId>
+          <artifactId>clover</artifactId>
+        </dependency>
+      </dependencies>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-failsafe-plugin</artifactId>
+            <configuration>
+              <systemProperties combine.children="append">
+                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
+                     WEB-INF/lib -->
+                <property>
+                  <name>xwiki.test.ui.profiles</name>
+                  <value>clover</value>
+                </property>
+              </systemProperties>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
+</project>
\ No newline at end of file
diff --git a/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/AllITs.java b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/AllITs.java
new file mode 100644
index 0000000000000..abb3ee2e0cfa2
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/AllITs.java
@@ -0,0 +1,39 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.help.test.ui.docker;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.xwiki.test.docker.junit5.UITest;
+
+/**
+ * All UI Tests for the Help Application.
+ *
+ * @version $Id$
+ */
+@UITest
+class AllITs
+{
+    @Nested
+    @DisplayName("Tips panel")
+    class NestedPanelIT extends TipsPanelIT
+    {
+    }
+}
diff --git a/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/TipsPanelIT.java b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/TipsPanelIT.java
new file mode 100644
index 0000000000000..37d4558f556e6
--- /dev/null
+++ b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-test/xwiki-platform-help-test-docker/src/test/it/org/xwiki/help/test/ui/docker/TipsPanelIT.java
@@ -0,0 +1,116 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.help.test.ui.docker;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Order;
+import org.junit.jupiter.api.Test;
+import org.xwiki.model.reference.DocumentReference;
+import org.xwiki.model.reference.LocalDocumentReference;
+import org.xwiki.panels.test.po.PanelViewPage;
+import org.xwiki.rendering.syntax.Syntax;
+import org.xwiki.rendering.wikimacro.internal.WikiMacroClassDocumentInitializer;
+import org.xwiki.rest.model.jaxb.Objects;
+import org.xwiki.rest.model.jaxb.Page;
+import org.xwiki.test.docker.junit5.TestReference;
+import org.xwiki.test.docker.junit5.UITest;
+import org.xwiki.test.ui.TestUtils;
+import org.xwiki.uiextension.internal.UIExtensionClassDocumentInitializer;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.xwiki.test.ui.TestUtils.RestTestUtils.object;
+import static org.xwiki.test.ui.TestUtils.RestTestUtils.property;
+
+/**
+ * Validate the Tips panel.
+ *
+ * @version $Id$
+ */
+@UITest
+class TipsPanelIT
+{
+    private final static String TIPS_UIXP = "org.xwiki.platform.help.tipsPanel";
+
+    private final static String TIPS_UIXP_DISABLED = TIPS_UIXP + ".disabled";
+
+    @BeforeEach
+    void setUp(TestUtils testUtils)
+    {
+        testUtils.loginAsSuperAdmin();
+    }
+
+    @Test
+    @Order(1)
+    void verifyTipsPropertyIsRestricted(TestUtils testUtils, TestReference testReference) throws Exception
+    {
+        // Unregister all tips
+        switchUIXs(TIPS_UIXP, TIPS_UIXP_DISABLED, testUtils);
+
+        // Register a macro to check if the context is restricted
+        registerIsrestrictedMacro(testUtils);
+
+        // Create a tip with tip property
+        Page tipPage = testUtils.rest().page(testReference);
+        tipPage.setObjects(new Objects());
+        org.xwiki.rest.model.jaxb.Object tipObject = object(UIExtensionClassDocumentInitializer.CLASS_REFERENCE_STRING);
+        tipObject.getProperties().add(property("extensionPointId", "org.xwiki.platform.help.tipsPanel"));
+        tipObject.getProperties().add(property("parameters",
+            "tip=execution is restricted: {{isrestricted/}}"));
+        tipPage.getObjects().getObjectSummaries().add(tipObject);
+        testUtils.rest().save(tipPage);
+
+        // Execute the tip panel and verify the result is restricted (the velocity macro is forbidden)
+        testUtils.gotoPage(new DocumentReference("xwiki", "Help", "TipsPanel", "WebHome"));
+        PanelViewPage panelPage = new PanelViewPage();
+        assertEquals("execution is restricted: true", panelPage.getPanelContent().getText());
+
+        // Put back all tips
+        switchUIXs(TIPS_UIXP_DISABLED, TIPS_UIXP, testUtils);
+    }
+
+    private void switchUIXs(String oldid, String newid, TestUtils testUtils) throws Exception
+    {
+        testUtils.executeWiki(String.format(
+        // @formatter:off
+            "{{velocity}}\n"
+            + "#foreach($uix in $services.uix.getExtensions('%s'))\n"
+            + "  #set ($uixDocument = $xwiki.getDocument($uix.documentReference))\n"
+            + "  $uixDocument.set('extensionPointId', '%s')\n"
+            + "  $uixDocument.save()\n"
+            + "#end\n"
+            + "{{/velocity}}", oldid, newid)
+            // @formatter:on
+            , Syntax.XWIKI_2_1);
+    }
+
+    private void registerIsrestrictedMacro(TestUtils testUtils) throws Exception
+    {
+        LocalDocumentReference macroReference = new LocalDocumentReference("Test", "IsrestrictedMacro");
+        Page macroPage = testUtils.rest().page(macroReference);
+        macroPage.setObjects(new Objects());
+        org.xwiki.rest.model.jaxb.Object tipObject = object(WikiMacroClassDocumentInitializer.WIKI_MACRO_CLASS);
+        tipObject.getProperties().add(property("id", "isrestricted"));
+        tipObject.getProperties().add(property("supportsInlineMode", 1));
+        tipObject.getProperties().add(property("code",
+            "{{velocity}}$wikimacro.context.transformationContext.isRestricted(){{/velocity}}"));
+        macroPage.getObjects().getObjectSummaries().add(tipObject);
+        testUtils.rest().save(macroPage);
+    }
+}
diff --git a/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/main/resources/Help/TipsPanel/WebHome.xml b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/main/resources/Help/TipsPanel/WebHome.xml
index a307b188ec640..f15f845cbb36d 100644
--- a/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/main/resources/Help/TipsPanel/WebHome.xml
+++ b/xwiki-platform-core/xwiki-platform-help/xwiki-platform-help-ui/src/main/resources/Help/TipsPanel/WebHome.xml
@@ -171,11 +171,13 @@
       <content>{{velocity}}
 #panelheader($services.localization.render('help.tipsPanel.title'))
 #set ($uixs = $services.uix.getExtensions('org.xwiki.platform.help.tipsPanel'))
 #if ($uixs.size() &gt; 0)
   #set ($index = $mathtool.random(0, $uixs.size()))
-  $uixs.get($index).getParameters().get('tip')
+  #set ($tip = $uixs.get($index).getParameters().get('tip'))
+  ## Execute the content in restricted mode as it's not executed with the right author
+  {{context restricted="true" transformationContext="transformations" source="script:tip"/}}
 #else
   $services.localization.render('help.tipsPanel.noTipMessage')
 #end
 #panelfooter()
 {{/velocity}}</content>
diff --git a/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java b/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java
index 3bd62467e04af..a24e652848319 100644
--- a/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java
+++ b/xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java
@@ -17,22 +17,36 @@
  * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
 package org.xwiki.panels.test.po;
 
+import org.openqa.selenium.WebElement;
+import org.openqa.selenium.support.FindBy;
 import org.xwiki.test.ui.po.ViewPage;
 
 /**
  * Represents a panel page in view mode.
  * 
  * @version $Id$
  * @since 4.3.1
  */
 public class PanelViewPage extends ViewPage
 {
+    @FindBy(className = "xwikipanelcontents")
+    private WebElement content;
+
     @SuppressWarnings("unchecked")
     @Override
     protected PanelEditPage createInlinePage()
     {
         return new PanelEditPage();
     }
+
+    /**
+     * @since 15.1RC1
+     * @since 14.10.5
+     */
+    public WebElement getPanelContent()
+    {
+        return this.content;
+    }
 }
diff --git a/xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java b/xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java
index 7b90e2a05d5ff..d1f901289bee9 100644
--- a/xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java
+++ b/xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java
@@ -38,10 +38,11 @@
 import java.util.Locale;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Properties;
 import java.util.Set;
+import java.util.UUID;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response.Status;
@@ -84,10 +85,11 @@
 import org.xwiki.model.reference.EntityReferenceSerializer;
 import org.xwiki.model.reference.LocalDocumentReference;
 import org.xwiki.model.reference.ObjectPropertyReference;
 import org.xwiki.model.reference.ObjectReference;
 import org.xwiki.model.reference.SpaceReference;
+import org.xwiki.rendering.syntax.Syntax;
 import org.xwiki.rest.model.jaxb.Page;
 import org.xwiki.rest.model.jaxb.Property;
 import org.xwiki.rest.model.jaxb.Xwiki;
 import org.xwiki.rest.resources.attachments.AttachmentResource;
 import org.xwiki.rest.resources.classes.ClassPropertyResource;
@@ -1122,19 +1124,27 @@ public String getURL(EntityReference reference, String action, String queryStrin
     /**
      * @since 9.7RC1
      */
     public String executeAndGetBodyAsString(EntityReference reference, Map<String, ?> queryParameters) throws Exception
     {
-        String url = getURL(reference, "get", toQueryString(queryParameters));
-
-        GetMethod getMethod = executeGet(url);
+        gotoPage(getURL(reference, "get", toQueryString(queryParameters)));
+        
+        return getDriver().getPageSource();
+    }
 
-        String result = getMethod.getResponseBodyAsString();
+    /**
+     * @since 15.1RC1
+     * @since 14.10.5
+     */
+    public String executeWiki(String wikiContent, Syntax wikiSyntax) throws Exception
+    {
+        LocalDocumentReference reference =
+            new LocalDocumentReference(List.of("Test", "Execute"), UUID.randomUUID().toString());
 
-        getMethod.releaseConnection();
+        rest().savePage(reference, wikiContent, wikiSyntax.toIdString(), null, null);
 
-        return result;
+        return executeAndGetBodyAsString(reference, null);
     }
 
     /**
      * @since 7.2M2
      */
@@ -1593,13 +1603,15 @@ public String toQueryString(Object... queryParameters)
      */
     public String toQueryString(Map<String, ?> queryParameters)
     {
         StringBuilder builder = new StringBuilder();
 
-        for (Map.Entry<String, ?> entry : queryParameters.entrySet()) {
-            addQueryStringEntry(builder, entry.getKey(), entry.getValue());
-            builder.append('&');
+        if (queryParameters != null) {
+            for (Map.Entry<String, ?> entry : queryParameters.entrySet()) {
+                addQueryStringEntry(builder, entry.getKey(), entry.getValue());
+                builder.append('&');
+            }
         }
 
         return builder.toString();
     }
 

Vulnerable code:   $uixs.get($index).getParameters().get('tip')
        String url = getURL(reference, "get", toQueryString(queryParameters));

        GetMethod getMethod = executeGet(url);
        String result = getMethod.getResponseBodyAsString();
        getMethod.releaseConnection();
        return result;
        for (Map.Entry<String, ?> entry : queryParameters.entrySet()) {
            addQueryStringEntry(builder, entry.getKey(), entry.getValue());
            builder.append('&');
Fixed code:   <profiles>
    <profile>
      <id>integration-tests</id>
      <modules>
        <module>xwiki-platform-help-test</module>
      </modules>
    </profile>
  </profiles>
<?xml version="1.0" encoding="UTF-8"?>

<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.xwiki.platform</groupId>
    <artifactId>xwiki-platform-help</artifactId>
    <version>15.1-SNAPSHOT</version>
  </parent>
  <artifactId>xwiki-platform-help-test</artifactId>
  <name>XWiki Platform - Panels - Help - Parent POM</name>
  <packaging>pom</packaging>
  <description>XWiki Platform - Help - Tests - Parent POM</description>
  <properties>
    <!-- Don't run backward-compatibility checks in test modules since we don't consider them as public APIs -->
    <xwiki.revapi.skip>true</xwiki.revapi.skip>
    <!-- Don't run Checkstyle in test modules -->
    <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
  </properties>
  <profiles>
    <profile>
      <id>docker</id>
      <modules>
        <module>xwiki-platform-panels-test-docker</module>
      </modules>
    </profile>
  </profiles>
</project>
<?xml version="1.0" encoding="UTF-8"?>

<!--
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <parent>
    <artifactId>xwiki-platform-help-test</artifactId>
    <groupId>org.xwiki.platform</groupId>
    <version>15.1-SNAPSHOT</version>
  </parent>
  <modelVersion>4.0.0</modelVersion>
  <artifactId>xwiki-platform-help-test-docker</artifactId>
  <!-- TODO: Move to use "functional-test" in the future when http://jira.codehaus.org/browse/MNG-1911 is fixed,
       see https://jira.xwiki.org/browse/XWIKI-7683 -->
  <packaging>jar</packaging>
  <name>XWiki Platform - Help - Tests - Functional Docker Tests</name>
  <description>XWiki Platform - Help - Tests - Functional Tests in Docker</description>
  <properties>
    <!-- Functional tests are allowed to output content to the console -->
    <xwiki.surefire.captureconsole.skip>true</xwiki.surefire.captureconsole.skip>
  </properties>
  <dependencies>
    <!-- =========================================
         Runtime Dependencies for tested features.
         ========================================= -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-help-ui</artifactId>
      <version>${project.version}</version>
      <scope>runtime</scope>
      <type>xar</type>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-panels-ui</artifactId>
      <version>${project.version}</version>
      <scope>runtime</scope>
      <type>xar</type>
    </dependency>

    <!-- ================================
         Test only dependencies
         ================================ -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-test-docker</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-panels-test-pageobjects</artifactId>
      <version>${project.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <testSourceDirectory>src/test/it</testSourceDirectory>
    <plugins>
      <!-- We need to explicitly include the failsafe plugin since it's not part of the default maven lifecycle -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
      </plugin>
    </plugins>
  </build>
  <profiles>
    <profile>
      <id>clover</id>
      <!-- Add the Clover JAR to the WAR so that it's available at runtime when XWiki executes.
           It's needed because instrumented jars in the WAR will call Clover APIs at runtime when they execute. -->
      <dependencies>
        <dependency>
          <groupId>org.openclover</groupId>
          <artifactId>clover</artifactId>
        </dependency>
      </dependencies>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-failsafe-plugin</artifactId>
            <configuration>
              <systemProperties combine.children="append">
                <!-- Tell the Docker-based test to activate the Clover profile so that the Clover JAR is added to
                     WEB-INF/lib -->
                <property>
                  <name>xwiki.test.ui.profiles</name>
                  <value>clover</value>
                </property>
              </systemProperties>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.help.test.ui.docker;

import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Nested;
import org.xwiki.test.docker.junit5.UITest;

/**
 * All UI Tests for the Help Application.
 *
 * @version $Id$
 */
@UITest
class AllITs
{
    @Nested
    @DisplayName("Tips panel")
    class NestedPanelIT extends TipsPanelIT
    {
    }
}
/*
 * See the NOTICE file distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.xwiki.help.test.ui.docker;

import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Order;
import org.junit.jupiter.api.Test;
import org.xwiki.model.reference.DocumentReference;
import org.xwiki.model.reference.LocalDocumentReference;
import org.xwiki.panels.test.po.PanelViewPage;
import org.xwiki.rendering.syntax.Syntax;
import org.xwiki.rendering.wikimacro.internal.WikiMacroClassDocumentInitializer;
import org.xwiki.rest.model.jaxb.Objects;
import org.xwiki.rest.model.jaxb.Page;
import org.xwiki.test.docker.junit5.TestReference;
import org.xwiki.test.docker.junit5.UITest;
import org.xwiki.test.ui.TestUtils;
import org.xwiki.uiextension.internal.UIExtensionClassDocumentInitializer;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.xwiki.test.ui.TestUtils.RestTestUtils.object;
import static org.xwiki.test.ui.TestUtils.RestTestUtils.property;

/**
 * Validate the Tips panel.
 *
 * @version $Id$
 */
@UITest
class TipsPanelIT
{
    private final static String TIPS_UIXP = "org.xwiki.platform.help.tipsPanel";

    private final static String TIPS_UIXP_DISABLED = TIPS_UIXP + ".disabled";

    @BeforeEach
    void setUp(TestUtils testUtils)
    {
        testUtils.loginAsSuperAdmin();
    }

    @Test
    @Order(1)
    void verifyTipsPropertyIsRestricted(TestUtils testUtils, TestReference testReference) throws Exception
    {
        // Unregister all tips
        switchUIXs(TIPS_UIXP, TIPS_UIXP_DISABLED, testUtils);

        // Register a macro to check if the context is restricted
        registerIsrestrictedMacro(testUtils);

        // Create a tip with tip property
        Page tipPage = testUtils.rest().page(testReference);
        tipPage.setObjects(new Objects());
        org.xwiki.rest.model.jaxb.Object tipObject = object(UIExtensionClassDocumentInitializer.CLASS_REFERENCE_STRING);
        tipObject.getProperties().add(property("extensionPointId", "org.xwiki.platform.help.tipsPanel"));
        tipObject.getProperties().add(property("parameters",
            "tip=execution is restricted: {{isrestricted/}}"));
        tipPage.getObjects().getObjectSummaries().add(tipObject);
        testUtils.rest().save(tipPage);

        // Execute the tip panel and verify the result is restricted (the velocity macro is forbidden)
        testUtils.gotoPage(new DocumentReference("xwiki", "Help", "TipsPanel", "WebHome"));
        PanelViewPage panelPage = new PanelViewPage();
        assertEquals("execution is restricted: true", panelPage.getPanelContent().getText());

        // Put back all tips
        switchUIXs(TIPS_UIXP_DISABLED, TIPS_UIXP, testUtils);
    }

    private void switchUIXs(String oldid, String newid, TestUtils testUtils) throws Exception
    {
        testUtils.executeWiki(String.format(
        // @formatter:off
            "{{velocity}}\n"
            + "#foreach($uix in $services.uix.getExtensions('%s'))\n"
            + "  #set ($uixDocument = $xwiki.getDocument($uix.documentReference))\n"
            + "  $uixDocument.set('extensionPointId', '%s')\n"
            + "  $uixDocument.save()\n"
            + "#end\n"
            + "{{/velocity}}", oldid, newid)
            // @formatter:on
            , Syntax.XWIKI_2_1);
    }

    private void registerIsrestrictedMacro(TestUtils testUtils) throws Exception
    {
        LocalDocumentReference macroReference = new LocalDocumentReference("Test", "IsrestrictedMacro");
        Page macroPage = testUtils.rest().page(macroReference);
        macroPage.setObjects(new Objects());
        org.xwiki.rest.model.jaxb.Object tipObject = object(WikiMacroClassDocumentInitializer.WIKI_MACRO_CLASS);
        tipObject.getProperties().add(property("id", "isrestricted"));
        tipObject.getProperties().add(property("supportsInlineMode", 1));
        tipObject.getProperties().add(property("code",
            "{{velocity}}$wikimacro.context.transformationContext.isRestricted(){{/velocity}}"));
        macroPage.getObjects().getObjectSummaries().add(tipObject);
        testUtils.rest().save(macroPage);
    }
}
  #set ($tip = $uixs.get($index).getParameters().get('tip'))
  ## Execute the content in restricted mode as it's not executed with the right author
  {{context restricted="true" transformationContext="transformations" source="script:tip"/}}
import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;
    @FindBy(className = "xwikipanelcontents")
    private WebElement content;


    /**
     * @since 15.1RC1
     * @since 14.10.5
     */
    public WebElement getPanelContent()
    {
        return this.content;
    }
import java.util.UUID;
import org.xwiki.rendering.syntax.Syntax;
        gotoPage(getURL(reference, "get", toQueryString(queryParameters)));
        
        return getDriver().getPageSource();
    }
    /**
     * @since 15.1RC1
     * @since 14.10.5
     */
    public String executeWiki(String wikiContent, Syntax wikiSyntax) throws Exception
    {
        LocalDocumentReference reference =
            new LocalDocumentReference(List.of("Test", "Execute"), UUID.randomUUID().toString());
        rest().savePage(reference, wikiContent, wikiSyntax.toIdString(), null, null);
        return executeAndGetBodyAsString(reference, null);
        if (queryParameters != null) {
            for (Map.Entry<String, ?> entry : queryParameters.entrySet()) {
                addQueryStringEntry(builder, entry.getKey(), entry.getValue());
                builder.append('&');
            }