Branch: refs/heads/security-structural-interpolation Home: https://github.com/xwiki/xwiki-dev-llm Commit: a3fe6061421d28ba583d707bf3a335966a5532ec https://github.com/xwiki/xwiki-dev-llm/commit/a3fe6061421d28ba583d707bf3a335... Author: Vincent Massol <[email protected]> Date: 2026-09-01 (Tue, 01 Sep 2026) Changed paths: M xwiki/okf/conventions/security.md M xwiki/okf/index.md Log Message: ----------- [Misc] Add OKF security rule on structural interpolation into queries and references * okf/conventions/security.md: new "Structural interpolation" section. bindValue protects only a query's values and a reference's value; the class/space/page identifiers in an XWQL/HQL from, doc.object(...), where doc.space, order by, and the reference of include/display (and getObject/newObject/getDocument) have no escaper and must be literal constants, never interpolated from a variable. Covers the allow-list / matches() escape hatch, and the $doc (caller-chosen rendered page) vs $xcontext.macro.doc / $wikimacro.doc (the macro's own, trusted defining page) distinction. * okf/index.md: extend the security topic line to name the new rule. Co-Authored-By: Claude Opus 4.8 <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications