Lancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse57456f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git18045e0d31d27a05fd6c36b5f7bd604a0d05f7f378f45e0d31d27a05fd6c36b5f7bd604a0d05f7f378frefs/remotes/origin/6.2.x45e0d31d27a05fd6c36b5f7bd604a0d05f7f378f45e0d31d27a05fd6c36b5f7bd604a0d05f7f378frefs/remotes/origin/6.2.x3026df43e66c82d74fdaf07c75d56db339cf34913646df43e66c82d74fdaf07c75d56db339cf3491364refs/remotes/origin/6.3.x6df43e66c82d74fdaf07c75d56db339cf34913646df43e66c82d74fdaf07c75d56db339cf3491364refs/remotes/origin/6.3.x574198ca3ffa05755ef77382ca0e65444a609294d44198ca3ffa05755ef77382ca0e65444a609294d44refs/remotes/origin/6.4.x198ca3ffa05755ef77382ca0e65444a609294d44198ca3ffa05755ef77382ca0e65444a609294d44refs/remotes/origin/6.4.x43a3e9b3a1a829e2b076e72afa8bf8da6253ba6b31a3e9b3a1a829e2b076e72afa8bf8da6253ba6b31refs/remotes/origin/6.1.xa3e9b3a1a829e2b076e72afa8bf8da6253ba6b31a3e9b3a1a829e2b076e72afa8bf8da6253ba6b31refs/remotes/origin/6.1.x198ca3ffa05755ef77382ca0e65444a609294d44198ca3ffa05755ef77382ca0e65444a609294d44refs/remotes/origin/6.4.xhttps://github.com/Silverpeas/Silverpeas-Core1796976f0d418d1eb565dded101d00140960944e6aa6976f0d418d1eb565dded101d00140960944e6aarefs/remotes/origin/6.2.x6976f0d418d1eb565dded101d00140960944e6aa6976f0d418d1eb565dded101d00140960944e6aarefs/remotes/origin/6.2.x302f1c18f5b16ecf085b04a36a636aa4aa26ec5d773f1c18f5b16ecf085b04a36a636aa4aa26ec5d773refs/remotes/origin/6.3.xf1c18f5b16ecf085b04a36a636aa4aa26ec5d773f1c18f5b16ecf085b04a36a636aa4aa26ec5d773refs/remotes/origin/6.3.x574d221c6c65b1766978f5dd82f28c11c7ceaea9b23d221c6c65b1766978f5dd82f28c11c7ceaea9b23refs/remotes/origin/6.4.xd221c6c65b1766978f5dd82f28c11c7ceaea9b23d221c6c65b1766978f5dd82f28c11c7ceaea9b23refs/remotes/origin/6.4.x439dbcbf90b830646ccd42fb388d09dbe09ecea4e69dbcbf90b830646ccd42fb388d09dbe09ecea4e6refs/remotes/origin/6.1.x9dbcbf90b830646ccd42fb388d09dbe09ecea4e69dbcbf90b830646ccd42fb388d09dbe09ecea4e6refs/remotes/origin/6.1.xd221c6c65b1766978f5dd82f28c11c7ceaea9b23d221c6c65b1766978f5dd82f28c11c7ceaea9b23refs/remotes/origin/6.4.xhttps://github.com/Silverpeas/Silverpeas-Components179b3b8a633d5a98083849becc7464aebbca4218501b3b8a633d5a98083849becc7464aebbca4218501refs/remotes/origin/6.2.xb3b8a633d5a98083849becc7464aebbca4218501b3b8a633d5a98083849becc7464aebbca4218501refs/remotes/origin/6.2.x302586ebdd23e10f812e41a52cbf1a3a7f4a81fe924586ebdd23e10f812e41a52cbf1a3a7f4a81fe924refs/remotes/origin/6.3.x586ebdd23e10f812e41a52cbf1a3a7f4a81fe924586ebdd23e10f812e41a52cbf1a3a7f4a81fe924refs/remotes/origin/6.3.x574cd3dbdb143c1ba8d859484f154fd760c353dd0edcd3dbdb143c1ba8d859484f154fd760c353dd0edrefs/remotes/origin/6.4.xcd3dbdb143c1ba8d859484f154fd760c353dd0edcd3dbdb143c1ba8d859484f154fd760c353dd0edrefs/remotes/origin/6.4.x43070793013d99eb148b16b15d6a191b20b72bc82c070793013d99eb148b16b15d6a191b20b72bc82crefs/remotes/origin/6.1.x070793013d99eb148b16b15d6a191b20b72bc82c070793013d99eb148b16b15d6a191b20b72bc82crefs/remotes/origin/6.1.xcd3dbdb143c1ba8d859484f154fd760c353dd0edcd3dbdb143c1ba8d859484f154fd760c353dd0edrefs/remotes/origin/6.4.xhttps://github.com/Silverpeas/Silverpeas-Looks179abe99f69032413c083fb9ee7a98afc1e2ab5114dabe99f69032413c083fb9ee7a98afc1e2ab5114drefs/remotes/origin/6.2.xabe99f69032413c083fb9ee7a98afc1e2ab5114dabe99f69032413c083fb9ee7a98afc1e2ab5114drefs/remotes/origin/6.2.x302146430cd63566b3be410c8dd534faa57033583b3146430cd63566b3be410c8dd534faa57033583b3refs/remotes/origin/6.3.x146430cd63566b3be410c8dd534faa57033583b3146430cd63566b3be410c8dd534faa57033583b3refs/remotes/origin/6.3.x574b329103b18d9998a62da3553abb417ec1327d6e9b329103b18d9998a62da3553abb417ec1327d6e9refs/remotes/origin/6.4.xb329103b18d9998a62da3553abb417ec1327d6e9b329103b18d9998a62da3553abb417ec1327d6e9refs/remotes/origin/6.4.x4362ef5e63f545c1d332fb8e528897aff1fac5415062ef5e63f545c1d332fb8e528897aff1fac54150refs/remotes/origin/6.1.x62ef5e63f545c1d332fb8e528897aff1fac5415062ef5e63f545c1d332fb8e528897aff1fac54150refs/remotes/origin/6.1.xb329103b18d9998a62da3553abb417ec1327d6e9b329103b18d9998a62da3553abb417ec1327d6e9refs/remotes/origin/6.4.xhttps://github.com/Silverpeas/Silverpeas-Setup179c96d415a32db2f558555695b382b89c11ac347bec96d415a32db2f558555695b382b89c11ac347berefs/remotes/origin/6.2.xc96d415a32db2f558555695b382b89c11ac347bec96d415a32db2f558555695b382b89c11ac347berefs/remotes/origin/6.2.x30210719018413e414cfa70c0f64a945a72670797f410719018413e414cfa70c0f64a945a72670797f4refs/remotes/origin/6.3.x10719018413e414cfa70c0f64a945a72670797f410719018413e414cfa70c0f64a945a72670797f4refs/remotes/origin/6.3.x5743c2e5e96c0ee61f807fd61b5d43f84b63ec542983c2e5e96c0ee61f807fd61b5d43f84b63ec54298refs/remotes/origin/6.4.x3c2e5e96c0ee61f807fd61b5d43f84b63ec542983c2e5e96c0ee61f807fd61b5d43f84b63ec54298refs/remotes/origin/6.4.x432c1de09b276e4aa8622563451ebd70a4f24759ce2c1de09b276e4aa8622563451ebd70a4f24759cerefs/remotes/origin/6.1.x2c1de09b276e4aa8622563451ebd70a4f24759ce2c1de09b276e4aa8622563451ebd70a4f24759cerefs/remotes/origin/6.1.x3c2e5e96c0ee61f807fd61b5d43f84b63ec542983c2e5e96c0ee61f807fd61b5d43f84b63ec54298refs/remotes/origin/6.4.xhttps://github.com/Silverpeas/Silverpeas-Distribution1791bdb8f99972aa96dacfc6d8775a7364ab6e845c21bdb8f99972aa96dacfc6d8775a7364ab6e845c2refs/remotes/origin/6.2.x1bdb8f99972aa96dacfc6d8775a7364ab6e845c21bdb8f99972aa96dacfc6d8775a7364ab6e845c2refs/remotes/origin/6.2.x302e6cf90efb933ea1d65558af1cade3056ac4b6462e6cf90efb933ea1d65558af1cade3056ac4b6462refs/remotes/origin/6.3.xe6cf90efb933ea1d65558af1cade3056ac4b6462e6cf90efb933ea1d65558af1cade3056ac4b6462refs/remotes/origin/6.3.x5742d8a5e346fd50bd478e8532b3f5d9bfe3457c88e2d8a5e346fd50bd478e8532b3f5d9bfe3457c88erefs/remotes/origin/6.4.x2d8a5e346fd50bd478e8532b3f5d9bfe3457c88e2d8a5e346fd50bd478e8532b3f5d9bfe3457c88erefs/remotes/origin/6.4.x4364a1ed5c344bf6e81820366b63120c460193579c64a1ed5c344bf6e81820366b63120c460193579crefs/remotes/origin/6.1.x64a1ed5c344bf6e81820366b63120c460193579c64a1ed5c344bf6e81820366b63120c460193579crefs/remotes/origin/6.1.x2d8a5e346fd50bd478e8532b3f5d9bfe3457c88e2d8a5e346fd50bd478e8532b3f5d9bfe3457c88erefs/remotes/origin/6.4.xhttps://github.com/Silverpeas/Silverpeas-AssemblyAaEuydtl_VRRlkU-_mf3Silverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=6.4.xhttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=6.4.xbuild.yamlbuild.yamltarget/build.yamlfalse6.4.9-build26101274128636131545Silverpeas_Stable_AutoDeploy 6.4.9-build261012574false57468025SUCCESS1791780360714https://integration.silverpeas.org/jenkins/view/Continuous%20Autodeployment%20Build/job/Silverpeas_Stable_AutoDeploy/574/core-api/src/test/java/org/silverpeas/core/security/html/EmbeddedSourceValidatorTest.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-war/src/main/webapp/attachment/jsp/editAttachedFiles.jspcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-web/src/test/java/org/silverpeas/core/web/filter/IFrameCheckerTest.javad9bbf308e876bfbbc480b74aa82f1a2afe938d591791452716000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comKeep the WYSIWYG images whose source has characters forbidden by the URI syntax Since the fix of vulnerability #1459, a WYSIWYG content is sanitized at rendering and the media referring a non-allowed source are dropped. The source was checked by parsing it as a java.net.URI, so a src with a whitespace (or any other character the URI syntax forbids) was rejected and the img element silently disappeared from the rendered content, whereas the browsers accept such a URL by percent-encoding it themselves. EmbeddedSourceValidator now checks a source that isn't a well-formed URI the way a browser would send it: the characters a browser percent-encodes without interpreting them (whitespace, quotes, brackets, braces, ...) are encoded before the check. The backslashes and the control characters stay rejected, as a browser gives them a meaning of their own, and the percent sign isn't touched so that an encoded path traversal is still detected. Such a src was produced by the "Browse server" page of the editor: the attachment URL was passed through a javascript: href, and a browser percent-decodes the body of a javascript: URL before running it. The link now uses an onclick handler, which keeps the URL as served. Ported from master (a23ba5c09f) with the hexadecimal formatting of Java 11. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> 2026-10-08 11:45:16 +0200d9bbf308e876bfbbc480b74aa82f1a2afe938d59Keep the WYSIWYG images whose source has characters forbidden by the URI syntaxeditcore-war/src/main/webapp/attachment/jsp/editAttachedFiles.jspeditcore-web/src/test/java/org/silverpeas/core/web/filter/IFrameCheckerTest.javaaddcore-api/src/test/java/org/silverpeas/core/security/html/EmbeddedSourceValidatorTest.javaeditcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-web/src/test/resources/org/silverpeas/util/security.propertiescore-web/src/main/java/org/silverpeas/core/web/filter/OpeningTag.javacore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-configuration/src/main/config/properties/org/silverpeas/util/security.propertiescore-web/src/test/java/org/silverpeas/core/web/filter/ScriptCheckerTest.javacore-api/src/test/java/org/silverpeas/core/security/html/EmbeddedSourceValidatorTest.javacore-web/src/main/java/org/silverpeas/core/web/filter/ScriptChecker.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterIT.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javacore-web/src/integration-test/resources/org/silverpeas/util/security.propertiescore-web/src/test/java/org/silverpeas/core/web/filter/IFrameCheckerTest.java9a5e4924a0c6c703395947a3a87c3e8f82fab9711791547224000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comBug #15502 Allow again the scripts in the WYSIWYG contents for trusted source Since 6.4.7, the content of the WYSIWYG editor is checked against the XSS injections like any other request parameter, and the contents are sanitized when rendered or exported. Any script was then both rejected by MassiveWebSecurityFilter and dropped by SanitizeForRenderingDirective, whereas our customers use scripts to make their web pages dynamic (webPages application). A script is now accepted, at both ends, provided it carries no code by itself and it loads it from an allowed source. The rule on the sources is the one already applied to the iframes and to the media (EmbeddedSourceValidator): the Silverpeas application is always allowed, the external hosts have to be declared, by HTTPS only. For the scripts they are declared by the new property security.external.script.hosts.allowed, empty by default. This shared rule is refined: the weblib web application, which serves beside Silverpeas the resources specific to the platform, is now always allowed too, for the scripts as well as for the iframes and the media. The files attached to the contributions are uploaded by the users themselves, so a script loading its code from one of them is refused unless the new property security.script.attachments.allowed is explicitly set to true (false by default, no value being equivalent to false). The routes of the file servers are concerned, among which the permalink of a file as it redirects to it. The iframes aren't concerned: an attached file, like a PDF document, can still be embedded, the file servers serving it along with a content security policy forbidding it any script. On the filter side, a script is accepted only when it is strictly parsed: a well-formed opening tag with a single src attribute, directly followed by its closing tag. A closing tag alone is still rejected. On the rendering side, whatever an allowed script carries by itself is dropped. Fix also a bypass of the filter on the source of the iframes: the HTML entities were decoded as the HTML 4 ones only, whereas the browsers know far more of them and decode them even loosely written. So a source such as "https&colon;//www.evil.org/" was taken for a relative URL within Silverpeas. The attribute values are now decoded by the decoder of the OWASP sanitizer, the one by which the contents being rendered are read, so that both ends read a source the same way. The strict parsing of an opening tag is extracted from IFrameChecker into OpeningTag in order to be shared with ScriptChecker. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> 2026-10-09 14:00:24 +02009a5e4924a0c6c703395947a3a87c3e8f82fab971Bug #15502 Allow again the scripts in the WYSIWYG contents for trusted sourceeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javaeditcore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-configuration/src/main/config/properties/org/silverpeas/util/security.propertieseditcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterIT.javaaddcore-web/src/main/java/org/silverpeas/core/web/filter/ScriptChecker.javaeditcore-web/src/test/java/org/silverpeas/core/web/filter/IFrameCheckerTest.javaeditcore-api/src/test/java/org/silverpeas/core/security/html/EmbeddedSourceValidatorTest.javaeditcore-web/src/integration-test/resources/org/silverpeas/util/security.propertiesaddcore-web/src/main/java/org/silverpeas/core/web/filter/OpeningTag.javaeditcore-web/src/test/resources/org/silverpeas/util/security.propertieseditcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaaddcore-web/src/test/java/org/silverpeas/core/web/filter/ScriptCheckerTest.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-web/src/main/java/org/silverpeas/core/web/filter/XssPatternChecker.javacore-web/src/test/java/org/silverpeas/core/web/filter/XssCheckerTest.javacore-web/src/main/java/org/silverpeas/core/web/filter/exception/WebXssInjectionSecurityException.javacore-web/src/main/java/org/silverpeas/core/web/filter/OpeningTag.javacore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web/src/main/java/org/silverpeas/core/web/filter/XssChecker.javacore-web/src/test/java/org/silverpeas/core/web/filter/ScriptCheckerTest.javacore-web/src/main/java/org/silverpeas/core/web/filter/SecurityChecker.javacore-web/src/main/java/org/silverpeas/core/web/filter/ScriptChecker.javacore-web/src/main/java/org/silverpeas/core/web/filter/SecurityCheckerProvider.javacore-web/src/test/java/org/silverpeas/core/web/filter/XssPatternCheckerTest.javacore-web/src/main/java/org/silverpeas/core/web/filter/exception/WebSecurityException.javacore-web/src/test/java/org/silverpeas/core/web/filter/IFrameCheckerTest.javacore-web/src/main/java/org/silverpeas/core/web/filter/MessageFilter.java198ca3ffa05755ef77382ca0e65444a609294d441791553299000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comBug #15502 Tell the reason for which a value is rejected as a XSS injection A rejected request was answered and logged with the sole generic message "Attempt of a XSS injection detected", so neither the writer of a content nor an administrator could know what to fix. The case that revealed it is a self-closing script tag, <script src="/weblib/toto.js"/>, which isn't closed in HTML: the browsers read the rest of the document as the code of the script, and the filter rightly refuses a script not immediately followed by its closing tag. The XSS checks now tell the reason of a rejection along with an excerpt of what has been detected: a forbidden element, an event callback attribute, a scripting scheme as an attribute value, the non-allowed source of an iframe or of a script, a script not immediately closed, a closing script tag alone, an iframe or a script that cannot be strictly parsed. The reason is carried by WebSecurityException as a detail apart from the message: it is logged, whereas the client is still answered the generic message only, so that an attacker isn't helped in adjusting a payload. The checks are reorganized around the SecurityChecker interface, which the IFrameChecker, the ScriptChecker and the new XssPatternChecker (the patterns formerly held by the filter) implement. XssChecker composes the checkers it is given, in their order, and tells the first rejection. The SecurityCheckerProvider is the only one to know the implementations and how to set them up for a request: a new kind of check is introduced by a new implementation registered there, without any other change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> 2026-10-09 15:41:39 +0200198ca3ffa05755ef77382ca0e65444a609294d44Bug #15502 Tell the reason for which a value is rejected as a XSS injectioneditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/exception/WebSecurityException.javaaddcore-web/src/test/java/org/silverpeas/core/web/filter/XssPatternCheckerTest.javaaddcore-web/src/main/java/org/silverpeas/core/web/filter/XssChecker.javaeditcore-web/src/test/java/org/silverpeas/core/web/filter/IFrameCheckerTest.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaaddcore-web/src/main/java/org/silverpeas/core/web/filter/SecurityCheckerProvider.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/ScriptChecker.javaaddcore-web/src/main/java/org/silverpeas/core/web/filter/SecurityChecker.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MessageFilter.javaaddcore-web/src/main/java/org/silverpeas/core/web/filter/XssPatternChecker.javaaddcore-web/src/test/java/org/silverpeas/core/web/filter/XssCheckerTest.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/OpeningTag.javaeditcore-web/src/test/java/org/silverpeas/core/web/filter/ScriptCheckerTest.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/exception/WebXssInjectionSecurityException.javagithttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse573https://integration.silverpeas.org/jenkins/view/Continuous%20Autodeployment%20Build/job/Silverpeas_Stable_AutoDeploy/573/