Security Issues

Originally the projectdoc Toolbox was designed for small teams of developers where the team had full access to the server. Therefore making use cases possible had been the main concern at first. So we were for instance allowing any protocol for a HTTP request to enable the team to access their ressource. This has changed since larger companies started to use the projectdoc Toolbox for the information architecture.

As a preparation step for data center support this release removes a couple of security related issues. The attacker needed to have write access privileges to pages to take advantage of these issues.

To not break existing API this version introduces strict HTML rendering as a feature required to actively turned on. In the next major version this feature is activated by default.

The following issues fall into this category.

Key	Summary	T	P	Description
PDAC-1481	Table Header Encodings			The rendering of names provided as values for the select parameter are rendered as specified. They must be encoded. Other than for the template use case there is no use case for having HTML code in this case. Therefore the strict HTML encoding system property must not be applied here.
PDAC-1478	Template Encoding			Select Templates allow to add HTML tags to control the rendering. This is a security issue since users with write access may add unwanted tags. Use PDAC-1462 Done to store templates with allowed HTML code as space properties. The strict rendering is off per default for version 4 of the projectdoc Toolbox. It will be the default for version 5. Use the system property de.smartics.projectdoc.security.strictHtmlEncoding set to true to demand strict encoding.
PDAC-1476	Limit allowed Protocols for External Quote Macro			The Quote External Macro should only allow links for author and source URI with the following protocols due to security consideration: "http", "https", "ftp", "ftps", "mailto", "nntp", "news", "irc"
PDAC-1475	Limit allowed Protocols for External Link Macro			The Link External Macro should only allow links with the following protocols due to security consideration: "http", "https", "ftp", "ftps", "mailto", "nntp", "news", "irc"
PDAC-1485	Always Encode Space Attributes			The Display Space Attribute Macro allows to render space information provided by Confluence. With version 4.13 the rendering depended on a system property, whether the value was encoded or not. With this version the value will always be encoded. This is because the value on the Confluence side is always considered as text.
PDAC-1489	Encoding Issues with Change Log Macro			The rendering of the macro does not fully encode all content.
PDAC-1487	Tour Macro Fails to Encode CSS classes			The CSS class parameter is rendered without encoding.
PDAC-1482	Encoding Issue in Autocomplete			Copying the Name List Macro's names to the autocomplete field fails to encode the attribute value.
PDAC-1479	HTML Code in Short Descriptions			The projectdoc Toolbox allows HTML code in short descriptions in page and space blueprints. This imposes a security issue in case a user with write access adds malicious code in the short description. The strict rendering is off per default for version 4 of the projectdoc Toolbox. It will be the default for version 5. Use the system property de.smartics.projectdoc.security.strictHtmlEncoding set to true to demand strict encoding. Note that encoding in short descriptions for page blueprints is covered by PDAC-1478 Done .

9 issues

Reference Support for Query Parameters

Query parameters may specify complex templates to render property values. To store these templates in one location as a space property, the macro parameters 'select', 'where', and 'sort-by' (for instance of the Display Table Macro) now support referencing templates. The template of the Display Document Properties Macro also supports this reference.

Simply introduce the parameter value with the paragraph sign (§) and then add the name of the space property that defines the template.

Note that the template may be formatted with the Confluence editor. For instance to set a property in italics or add a line break.

See PDAC-1462 - Reference Support for Query Parameters Done and PDAC-1466 - Support Space Templates for Display Properties Macro Done for more information.

Detect Health Issues

The Name List Macro allows to specify arbitrary names. If the name is actually referencing a document, a link is rendered. This approach is different from using a display property macro where the referenced document is required to exist. The projectdoc Toolbox speaks of name macros as dynamic links and display property macros as dynamic links.

Dynamic links may loose the target document involuntarily. These issues are hard to detect. To help users to find and fix these issues this version of the projectdoc Toolbox adds the following improvements and features.

Key	Summary	T	P	Description
PDAC-1470	Debug Mode for Tour-by-Property Macro			In debug mode the Tour-by-Property should render a message in case the properties do not all point to a valid name.
PDAC-1473	Debug Access Mode			Add additional space property named "projectdoc.debug-mode.access" to control whether or not debugging should only happen to UI in case the user has actual write access to the page with issues. The default is to render debug information only when user has write access.
PDAC-1472	Health Logging			Provide a collection of loggers prefixed with 'de.smartics.projectdoc.healthCheck' to signal issues with health.
PDAC-1464	Display of missing Index Entries			The Index Entries Macros fails to properly render all missing entries in Debug Mode.

4 issues

Space Property Rendering

We encountered HTML encoding issues with the rendering of space properties. 

Originally the space properties where intended to be plain text properties to be used as variables for matching only. This simple concept has been abandoned a long time ago. Today a space property may contain any HTML fragment. With PDAC-1469 - Encode Issue with Space Properties Done we fix an issue where the rendered property may not have been HTML encoded.

Preparation for Data Center Support

We are working to get the data center compatibility approval of Atlassian for the projectdoc Toolbox.

We plan to provide the data center version by the end of 2021. In summer we will release version 5.0 of the projectdoc Toolbox that will require to update the database tables. This may come inconvenient since this will require to recalculate the document entries in these tables. For instance with a large number of projectdoc documents we recommend to check the upgrade in a test instance to estimate how long the table update will take.

To prepare your installation for this version we recommend to set system property de.smartics.projectdoc.security.strictHtmlEncoding to true. This will require to use the new template references for complex select templates where HTML code is required for rendering.

Please refer to PDAC-1478 - Template Encoding Done and PDAC-1462 - Reference Support for Query Parameters Done for more information.

Reindex

Due to the following issues a reindex is required to update properties.

Key	Summary	T	P	Description
PDAC-1474	URL and Tiny URL Representation			The artificial properties "URL" and "Tiny URL" are stored in HTML plain text, but should be stored in HTML. All documents need to be reindexed to get the new, corrected value.

1 issue

In case you do not use any of these features, there is no need for a reindex.

Please refer to Troubleshooting Reindexer for projectdoc Documents for details on how to reindex projectdoc documents.