CVE-2023-45144 (Other, published 2023-10-16T21:15Z)
Description: value: com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwikisas/identity-oauth
Files changed:
ui/src/main/resources/IdentityOAuth/IdentityOAuthConfigMacros.vm
ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm
ui/src/main/resources/IdentityOAuth/Translations.de.properties
ui/src/main/resources/IdentityOAuth/Translations.fr.properties
ui/src/main/resources/IdentityOAuth/Translations.properties
ui/src/main/resources/IdentityOAuth/WebHome.xml
Commit message: Improve escaping (#30)

* remove unnecessary empty lines that where displayed when the macro was called
* don't escape links in translations; let the code using the translation to do the right link wrapping after escaping
* refactor some translation macros
* update translations that are used as fallback values in order to use the best practice for having links in translation

Vulnerable code:




  ## t: shorthand for translation
  #macro (t $name)
    $services.localization.render($tn)

  ## tp: shorthand for translation with parameters
  #macro (tp $name $params)##
    #set ($msg = $services.localization.render($tn,$params))##
    ## convert to <a href="link">link-text</a> for the simple wiki syntax of links
    $stringtool.replacePattern($msg, '\[\[([^>]*)>>([^\]]*)\]\]', '<a href="$2">$1</a>')##
      window.placeHolderForRedirectUrl = '#tp("redirectUrl.placeHolderMessage", ["${serverReturn}"])';
        #set($successM = ${services.localization.render("idoauth.login.redirectmessage")})
      #set($statusMsg = "no such identityOAuth operation '$request.identityOAuth'")
    <!-- ======= ${statusMsg} ====== -->
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint=Um eine OAuth Integration zu aktivieren, musst du {0}dein Wiki als App für den OAuth Zugang bei dem Provider registrieren{1} und die genannten Client-ID und Clientschlüssel in den folgenden Einstellungen einfügen.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2=Du erhälst mehr Information in den {0}Installationsanweisungen{1}.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint=Afin d''activer l''intégration OAuth vous devez vous enregistrer pour l''accès à OAuth chez le fournisseur et insérer les informations dans les paramètres suivants.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2=Voir aussi {0}les instructions d''installation{1}.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint=To activate an OAuth integration you need to {0}register for OAuth access to the provider''s configuration{1} and to insert your Client-Id and secret in the following settings.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2=For more information, please see {0}the installation instructions{1}.
idoauth.webHome.1=This is the code for the Identity OAuth extension, allowing to integrate XWiki with external provider's identities.
idoauth.webHome.4=Go to Provider's section of the XWiki Preferences in order to configure the application.
	$services.localization.render('idoauth.webHome.1')
	$services.localization.render('idoauth.webHome.2')
	$services.localization.render('idoauth.webHome.3')
  $services.localization.render('idoauth.webHome.4')
[[=&gt; More about the IdentityOAuth Application>>https://store.xwiki.com/xwiki/bin/view/Extension/IdentityOAuth]].

Fixed code:
    ## Handle translation prefixes.
    ## Handle extra class properties.
  ##
  ## Macros used in managing providers translations. t is for translation and tp for translation with parameters.
  ##
  #macro (getTranslation $name $usage $translation)
    #if ($usage == 'js')
      #set ($translation = $escapetool.javascript($services.localization.render($tn)))
    #else
      #set ($translation = $escapetool.xml($services.localization.render($tn)))
    #end
  ## Display translation.
  #macro (t $name $usage)
    #getTranslation($name $usage $translation)
    $translation
  #end
  ## Get translation with parameters.
  #macro (tp $name $params $usage $translation)
    #set ($msg = $services.localization.render($tn, $params))##
    #if ($usage == 'js')
      #set ($translation = $escapetool.javascript($msg))
    #else
      #set ($translation = $escapetool.xml($msg))
    #end
      #tp("redirectUrl.placeHolderMessage", ["${serverReturn}"], "js", $translation)
      window.placeHolderForRedirectUrl = "${translation}";
        #set ($successMsg = ${services.localization.render("idoauth.login.redirectmessage")})
      #set ($statusMsg = "no such identityOAuth operation '$request.identityOAuth'")
    <!-- ======= ${escapetool.xml($statusMsg)} ====== -->
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint=Um eine OAuth Integration zu aktivieren, musst du {0} und die genannten Client-ID und Clientschlüssel in den folgenden Einstellungen einfügen.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint.linkLabel=dein Wiki als App für den OAuth Zugang bei dem Provider registrieren
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2=Du erhälst mehr Information in den {0}.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2.linkLabel=Installationsanweisungen
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint=Afin d''activer l''intégration OAuth vous devez {0} et insérer les informations dans les paramètres suivants.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint.linkLabel=vous enregistrer pour l''accès à OAuth chez le fournisseur
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2=Voir aussi {0}.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2.linkLabel=les instructions d''installation
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint=To activate an OAuth integration you need to {0} and to insert your Client-Id and secret in the following settings.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint.linkLabel=register for OAuth access to the provider''s configuration
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2=For more information, please see {0}.
IdentityOAuth.IdentityOAuthConfigClass_communicate.hint2.linkLabel=the installation instructions
idoauth.webHome.1=This is the code for the Identity OAuth extension, allowing to integrate XWiki with external provider identities.
idoauth.webHome.4=Go to the administration section of your specific provider in order to configure the application. 
  $escapetool.xml($services.localization.render('idoauth.webHome.1'))
  $escapetool.xml($services.localization.render('idoauth.webHome.2'))
  $escapetool.xml($services.localization.render('idoauth.webHome.3'))
  $escapetool.xml($services.localization.render('idoauth.webHome.4'))
[[=&gt; More about the IdentityOAuth Application&gt;&gt;https://store.xwiki.com/xwiki/bin/view/Extension/IdentityOAuth]].