Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-13451

XSS bug in wiki markup link rendering

XMLWordPrintable

      The following wikimarkup creates links with an onclick event.

      [test link|mailto:whatever@broken.com" onclick="alert('hi. I am a fun onclick event')]
[test link|mailto:whatever@broken.com" onclick="alert('hi. I am a fun onclick event')]

      This is due to the following code in ConfluenceLinkResolver at line 319 (ish)

      // in private boolean isUrlLink(String textWithoutTitle)

        if (textWithoutTitle.startsWith("mailto:") || textWithoutTitle.startsWith("file:"))
        {
            return true;
        }
        else
        {
            // URLs don't strictly allow single quote characters, but we want to allow one
            String encodedText = textWithoutTitle.replaceAll("'","");
            boolean isUrl = UrlUtils.verifyHierachicalURI(encodedText);
            return isUrl;
        }

      I haven't checked how far back this actually goes, but I suspect it's a long way.

        1. atlassian-renderer-3.18.1.jar
          203 kB
        2. atlassian-renderer-3.19.1.jar
          208 kB

            [CONFSERVER-13451] XSS bug in wiki markup link rendering

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2895006 ] New: CONFSERVER Bug Workflow v4 [ 2987387 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2782752 ] New: JAC Bug Workflow v3 [ 2895006 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2707839 ] New: JAC Bug Workflow v2 [ 2782752 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2372385 ] New: JAC Bug Workflow [ 2707839 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2298560 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2372385 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2233382 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2298560 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2194560 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2233382 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1927635 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2194560 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v3 [ 1728803 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 1927635 ]
            Katherine Yabut made changes -
            Workflow Original: CONF Bug Subtask WF (TEMP) [ 1686096 ] New: Confluence Workflow - Public Facing - Restricted v3 [ 1728803 ]

              dtaylor David Taylor (Inactive)
              don.willis@atlassian.com Don Willis
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: