xwiki/xwiki-platform — pull request #134 by tdelafosse (2013-07-26 17:51:58+00:00)
Title: XE-1315 : URI Based Reflected XSS on XWIKI 4.5.2

As Abhisek (who reported this issue) stressed, this issue is due to the inject of the request query string in some menus.
Note that this attack works only on certain browser when the security mode is switched off. To avoid it nonetheless, I clean the queryString, so that injection won't work, even with an insecure browser. Another solution would be to html escape the query string, but I thought the present solution was cleaner.