Branch: refs/heads/claude/magical-faraday-9otsF Home: https://github.com/xwiki/xwiki-platform Commit: 5bfdb14445d48e297b1cc8a4b24f5e7ae8b5ac2b https://github.com/xwiki/xwiki-platform/commit/5bfdb14445d48e297b1cc8a4b24f5... Author: Claude <[email protected]> Date: 2026-05-20 (Wed, 20 May 2026) Changed paths: M xwiki-platform-core/xwiki-platform-captcha/xwiki-platform-captcha-api/src/main/java/org/xwiki/captcha/CaptchaException.java M xwiki-platform-core/xwiki-platform-captcha/xwiki-platform-captcha-jcaptcha/xwiki-platform-captcha-jcaptcha-api/src/main/java/org/xwiki/captcha/internal/CaptchaServiceManager.java A xwiki-platform-core/xwiki-platform-captcha/xwiki-platform-captcha-jcaptcha/xwiki-platform-captcha-jcaptcha-api/src/test/java/org/xwiki/captcha/internal/CaptchaServiceManagerTest.java Log Message: ----------- [SECURITY] Validate CaptchaEngine type before dynamic class loading Fixes SonarQube javasecurity:S6173 (dynamic class loading with potentially user-controlled input). In CaptchaServiceManager.getCaptchaService(), the engine class name could be influenced by untrusted input flowing through captchaParameters. The fix validates that the loaded class is assignable to CaptchaEngine before instantiating it, preventing arbitrary classes from being loaded. Also replaces the deprecated getConstructor(null).newInstance(null) with getDeclaredConstructor().newInstance(). Adds a message-only constructor to CaptchaException to support the new validation error path, and adds a CaptchaServiceManagerTest covering the validation logic. https://claude.ai/code/session_0175Ge3fDXFYeRBCxDeNx5vF To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications