Branch: refs/heads/stable-16.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 22f24a6eed5395af4694cb4e8652026991a06cd6 https://github.com/xwiki/xwiki-platform/commit/22f24a6eed5395af4694cb4e86520... Author: Michael Hamann <[email protected]> Date: 2026-06-10 (Wed, 10 Jun 2026) Changed paths: M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/XARImportIT.java A xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/resources/XARImportIT/XSSImport.xar M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/pom.xml M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/src/main/java/org/xwiki/administration/test/po/ImportAdministrationSectionPage.java M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/js/xwiki/importer/import.js Log Message: ----------- XWIKI-23755: Import package metadata is improperly escaped - Use textContent instead of Prototype.js's .update() method for displaying package metadata (package name, version, author, license, space name, document name, and attachment filename). - Add testXSSInPackageExplorer integration test that: - Uploads a XAR with HTML payloads in all displayed fields using a filename that itself contains HTML - Asserts each field is displayed as literal text (positive assertions) - Asserts no injected DOM elements with xss-* IDs exist (negative) - Adds XSSImport.xar test resource with unique HTML payloads per field Co-authored-by: Copilot <[email protected]> (cherry picked from commit cdc18aedf88094666f1b21646aaa09693b821e9b) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications