CVE-2023-29506 (Java, published 2023-04-16T07:15Z)
Description: value: XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandler.java
xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/resource/AuthenticationResourceReferenceHandlerTest.java
Commit message: XWIKI-20335: Wiki existence is not properly checked in authenticate


Vulnerable code:
        when(this.xwiki.evaluateTemplate("resetpassword.vm", context)).thenReturn("Reset password content");

        ResourceReferenceHandlerChain chain = mock(ResourceReferenceHandlerChain.class);


Fixed code:
import org.xwiki.wiki.descriptor.WikiDescriptorManager;
import org.xwiki.wiki.manager.WikiManagerException;
    @Inject
    private WikiDescriptorManager wikiDescriptorManager;

        WikiReference wikiReference = authenticationResourceReference.getWikiReference();
        try {
            if (!this.wikiDescriptorManager.exists(wikiReference.getName())) {
                throw new ResourceReferenceHandlerException(
                    String.format("The wiki [%s] does not exist.", wikiReference.getName()));
            }
        } catch (WikiManagerException e) {
            throw new ResourceReferenceHandlerException(
                String.format("Error when checking if wiki [%s] exists.", wikiReference.getName()), e);
        }

import org.xwiki.resource.ResourceReferenceHandlerException;
import org.xwiki.wiki.descriptor.WikiDescriptorManager;
import org.xwiki.wiki.manager.WikiManagerException;
import static org.junit.jupiter.api.Assertions.assertThrows;
    @MockComponent
    private WikiDescriptorManager wikiDescriptorManager;

        when(this.wikiDescriptorManager.exists("foo")).thenReturn(false);
        ResourceReferenceHandlerException exception =
            assertThrows(ResourceReferenceHandlerException.class,
                () -> this.resourceReferenceHandler.handle(resourceReference, chain));
        assertEquals("The wiki [foo] does not exist.", exception.getMessage());

        when(this.wikiDescriptorManager.exists("foo")).thenReturn(true);
        when(this.xwiki.evaluateTemplate("resetpassword.vm", context)).thenReturn("Reset password content");
        when(this.wikiDescriptorManager.exists("bar")).thenReturn(false);
        ResourceReferenceHandlerChain chain = mock(ResourceReferenceHandlerChain.class);
        ResourceReferenceHandlerException exception =
            assertThrows(ResourceReferenceHandlerException.class,
                () -> this.resourceReferenceHandler.handle(resourceReference, chain));
        assertEquals("The wiki [bar] does not exist.", exception.getMessage());

        when(this.wikiDescriptorManager.exists("bar")).thenReturn(true);

    @Test
    void handleForgotUsernameWikiDescriptorError() throws Exception
    {
        WikiReference wikiReference = new WikiReference("bar");
        when(this.wikiDescriptorManager.exists("bar")).thenThrow(new WikiManagerException("Cannot access wiki"));
        AuthenticationResourceReference resourceReference = new AuthenticationResourceReference(
            wikiReference,
            AuthenticationAction.RETRIEVE_USERNAME);

        ResourceReferenceHandlerChain chain = mock(ResourceReferenceHandlerChain.class);
        ResourceReferenceHandlerException exception =
            assertThrows(ResourceReferenceHandlerException.class,
                () -> this.resourceReferenceHandler.handle(resourceReference, chain));
        assertEquals("Error when checking if wiki [bar] exists.", exception.getMessage());
    }