High The following wikimarkup creates links with an onclick event.
[test link|mailto:whatever@broken.com" onclick="alert('hi. I am a fun onclick event')]
[test link|mailto:whatever@broken.com" onclick="alert('hi. I am a fun onclick event')]
This is due to the following code in ConfluenceLinkResolver at line 319 (ish)
// in private boolean isUrlLink(String textWithoutTitle) if (textWithoutTitle.startsWith("mailto:") || textWithoutTitle.startsWith("file:")) { return true; } else { // URLs don't strictly allow single quote characters, but we want to allow one String encodedText = textWithoutTitle.replaceAll("'",""); boolean isUrl = UrlUtils.verifyHierachicalURI(encodedText); return isUrl; }
I haven't checked how far back this actually goes, but I suspect it's a long way.
- is related to
-
CONFSERVER-3086 Hyperlink other protocols (e.g. notes://) automatically
- Closed
[CONFSERVER-13451] XSS bug in wiki markup link rendering
Attached are the patches for confluence 2.7-2.9.
Use:
- 3.18.1 for confluence 2.7.x
- 3.19.1 for confluence 2.8.x and 2.9.x
To apply the patch:
- Download the corresponding jar file
- Copy the jar to /confluence/WEB-INF/lib/
- Remove the older version of the jar file
- Restart confluence
Security patches need to be written for version 2.7, 2.8 and 2.9.
Implemented in Renderer 4.1. Need to update Confluence to depend on it once released.
See https://svn.atlassian.com/atlaseye/changelog/confluence?cs=23495 for the change
Reviewed in RNDR-43