Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-82741

Variables in user macro are not resolved



      The behaviour described in this issue is as intended as we've restricted the velocity render modules that can be used by User Macros out of the box. Previously the modules that User Macros could access were entirely unrestricted, which presented a potential information disclosure risk. To address this risk, we introduced allow listing of modules for User Macros.

      This change resulted in the issue detailed here. In response, we've improved the User Macro Administration interface to list modules that are used but have not been added to the allow list. Modules should be added to the sparingly to give the least required access possible. Administrators should carefully review what modules are added to ensure usage is in line with their expectations.

      More information on the allow listing and modules available can be found at Confluence objects accessible from Velocity.

      Again, we recommend against allow listing all velocity modules. As such I've removed the previously provided workaround that did just this.

      The fix for this bug has been released to our Long Term Support release.

      The fix for this bug is now available in the latest release of Confluence 7.13 and 7.19


      Inserting a User Macro with variables in a Confluence page results in the variables to be displayed as it and not substituted with their values.


      Confluence v7.19.7
      Postgres 13
      OS: Linux

      Steps to Reproduce

      1. Login as admin
      2. Define a new User Macro with the below template code:
        ## @noparams
        #set($userDetailsManager = $containerContext.getComponent('userDetailsManager'))
        #set( $user = $action.remoteUser)
        Hello $req.userPrincipal.name</h1>
        <br />
        Hello $action.remoteUser.name
        <br />
        Hello $user.name
        $action.dateFormatter.formatGivenString("yyyy-MM-dd", $content.getCreationDate())
      1. Set Macro Body Processing to Rendered
      2. Create a new page and add the macro created above.
      3. Save the page

      Expected Results

      (Add expected results for current action)
      Variables in the macro are resolved.

      Actual Results

      (Add actual results for current action)
      Macro displays as shown below:


      Please review the User Macro administration interface and the documentation at Confluence objects accessible from Velocity to determine what modules should be allow listed.

      Modules can be added using the system property below


            5339cdd01cf4 Jeffery Xie
            63948a2d3746 Marco Salvi
            63 Vote for this issue
            112 Start watching this issue