CVE-2023-45144: Improve escaping (#30) · xwikisas/identity-oauth@d805d31

Expand Up @@ -21,42 +21,53 @@ #macro (initConfigObjects $configDocName $extraObjectClassPropPrefixes $translationPrefixesP) #set($formId = “${section.toLowerCase()}_${configDocName1}”) #set($configDoc = $xwiki.getDocument($configDocName))
#set($classNameIO="IdentityOAuth.IdentityOAuthConfigClass") #set($propNamePrefixIO="${configDoc.fullName}_${classNameIO}_0") #set($objIO = $configDoc.getObject($classNameIO))
## Handle translation prefixes. #set($translationPrefixes = []) #foreach($p in $translationPrefixesP) #set($nuts=$translationPrefixes.add($p)) #end #set($nuts=$translationPrefixes.add(‘IdentityOAuth.IdentityOAuthConfigClass_’))
## Handle extra class properties. #foreach($x in $extraObjectClassPropPrefixes) #set($shhh = $x.add($x[0])) #set($x[0] = $configDoc.getObject($x[0])) #end #end

## t: shorthand for translation ## ## Macros used in managing providers translations. t is for translation and tp for translation with parameters. ## #macro (alignWithTranslationPrefixes $name) #set($tn = []) #foreach($p in $translationPrefixes) #set($nuts=$tn.add(“${p}${name}”)) #end #end #macro (t $name) #macro (getTranslation $name $usage $translation) #alignWithTranslationPrefixes($name) $services.localization.render($tn) #if ($usage == ‘js’) #set ($translation = $escapetool.javascript($services.localization.render($tn))) #else #set ($translation = $escapetool.xml($services.localization.render($tn))) #end #end
## tp: shorthand for translation with parameters #macro (tp $name $params)## ## Display translation. #macro (t $name $usage) #getTranslation($name $usage $translation) $translation #end ## Get translation with parameters. #macro (tp $name $params $usage $translation) #alignWithTranslationPrefixes($name) #set ($msg = $services.localization.render($tn,$params))## ## convert to <a href="link">link-text</a> for the simple wiki syntax of links $stringtool.replacePattern($msg, '\[\[([^>]*)>>([^\]]*)\]\]', ‘<a href="$2">$1</a>’)## #set ($msg = $services.localization.render($tn, $params))## #if ($usage == ‘js’) #set ($translation = $escapetool.javascript($msg)) #else #set ($translation = $escapetool.xml($msg)) #end #end
## displayInput: displays the form element of the relevant property of the object having removed the Expand Down Expand Up @@ -93,7 +104,8 @@ // absUrl: $absUrl #set($serverReturn = “${absUrl.substring(0, $absUrl.indexOf('/’,8))}${serverReturn}”) #end window.placeHolderForRedirectUrl = '#tp("redirectUrl.placeHolderMessage", [“${serverReturn}”])'; #tp("redirectUrl.placeHolderMessage", [“${serverReturn}”], "js", $translation) window.placeHolderForRedirectUrl = "${translation}"; var p = window.location.href.indexOf(‘/admin’); window.browserReturnUrl = (p === -1 ? window.location.href : Expand Down