Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
4.2-milestone-1
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce:
Create a comment with content
{{cache}}{{groovy}}println("Hello from Groovy!"){{/groovy}}{{/cache}}
Expected result:
An error is displayed as the Groovy macro cannot be used in restricted mode.
Actual result:
The string "Hello from Groovy!" is displayed.
This demonstrates a privilege escalation from comment to programming rights. This bug is not specific to the cache macro but can be reproduced with any macro that uses the macro content parser with the transform parameter set to true as the default macro content parser doesn't preserve the restricted attribute of the transformation context.
This has always been the case since the introduction of the restricted attribute in XWIKI-7878.
Attachments
Issue Links
- is duplicated by
-
XWIKI-20375 RCE via comment
-
- Closed
-
- links to